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RELIABILITY  ANALYSIS  FOR  AIRFIELD 
LIGHTING  SYSTEMS 


1 INTRODUCTION 


Background 

Visual  guidance  lighting  systems  for  airports  provide  necessary  infor- 
mation for  aircraft  operation  during  approach,  landing,  take-off,  and 
ground  movement  (taxiing).  In  darkness,  inclement  weather,  or  other  per- 
iods of  low  visibility,  the  information  provided  by  these  systems  is  cri- 
tical to  safe  and  efficient  air  travel.  At  many  major  airports,  periods  of 
low  visibility  are  encountered  during  nearly  one-half  of  the  operating 
time. 


Although  significant  research  has  been  devoted  to  improving  component 
equipment  in  these  lighting  systems  and  to  delineating  the  pilot's  infor- 
mation requirements,  little  has  been  done  to  determine  the  operational 
reliability  of  the  lighting  systems  currently  in  use.  Because  these  systems 
are  critical  to  safe  ard  efficient  operations  and  because  installation  and 
maintenance  costs  for  such  systems  are  high,  procedures  to  analyze  the 
reliability  of  present  airfield  lighting  systems  are  needed. 


Purpose 

The  purpose  of  this  research  was  to  develop  procedures  for  evaluating 
the  functional  reliability  of  airfield  lighting  systems.  The  procedures 
developed  here  can  be  used  to  estimate  steady-state  system  reliability  for 
any  visual  guidance  lighting  system. 


Approach 

A three-step  approach  was  used  in  this  research:  development  of  the 
methodology,  development  of  the  model,  and  testing  of  the  model. 

The  methodology  for  evaluating  the  reliability  of  airfield  lighting 
systems  was  developed  through  reviewing  the  literature  concerning  airfield 
lighting  and  systems  analysis  of  reliability.  In  addition,  personnel  from 
the  Federal  Aviation  Administration  (FAA),  equipment  manufacturers,  and 
various  airports  were  contacted. 

The  second  step  produced  a general  lighting  system  model  which,  through 
user  selection  of  input,  can  be  used  to  evaluate  the  reliability  of  in- 
dividual lighting  systems.  This  model  was  then  automated  to  provide  a 
simple  and  efficient  procedure  for  performing  these  analyses. 

Finally,  the  model  was  tested  through  a sensitivity  analysis  of  the 
several  variables  influencing  system  reliability.  In  addition,  a limited 
field  examination  of  in-service  lighting  systems  was  undertaken. 
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Scope 


Due  to  the  complexity  of  the  problem,  the  number  of  lighting  systems 
in  use,  and  the  variety  of  components  within  each  system,  limitations  were 
placed  on  the  scope  of  this  project.  In  defining  the  scope,  the  following 
assumptions  were  made: 

a.  The  functional  design  of  individual  items  of  equipment  and  sys- 
tems is  adequate.  Thus,  in  defining  system  reliability,  no  attempt  was 
made  to  warrant  the  system  geometry  or  component  characteristics. 

b.  The  operational  characteristics  of  each  system  are  adequate.  The 
standards  selected  for  failure  criteria  were  those  presently  accepted,  and 
no  inference  was  made  as  to  the  level  of  information  conveyance  and  pilot 
perception  for  individual  lighting  systems. 

c.  Deviations  from  standard  lighting  systems  and  maintenance  practices 
will  be  treated  through  user  selection  of  input  variables. 


Organization  of  Report 

To  simplify  use  of  this  report,  the  body  of  the  report  summarizes  the 
study  findings,  which  are  documented  in  detail  in  the  appendices.  Appendix 
A discusses  the  modeling  of  visual  guidance  lighting  systems.  The  relia- 
bility methodology  used  is  described  in  Appendix  B.  Appendix  C presents 
the  derivation  of  the  consecutive  coefficient  introduced  to  account  for 
failure  criteria  stipulating  the  consecutive  outages  allowed  in  a lighting 
system.  Appendix  D is  the  user's  manual  for  the  automated  program  for 
evaluating  system  reliability,  including  an  example  problem.  Appendix  E 
details  the  sensitivity  analysis  of  the  model. 
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2 AIRFIELD  LIGHTING  SYSTEM  RELIABILITY 


Airfield  Lighting 

Appendix  A describes  lighting  systems  which  provide  pilots  with  visual 
guidance  during  poor  visibility  conditions.  The  references  listed  in  the 
bibliography  provide  additional  information  on  the  individual  systems. 

Although  each  system  is  comprised  of  specialized  equipment  in  con- 
figurations designed  to  convey  the  necessary  information  to  pilots,  they 
all  have  the  common  elements  of  a power  source,  power  circuitry,  and  light 
transmission  equipment.  Because  of  these  similarities,  a general  model  can 
be  used  to  define  all  the  lighting  systems. 

The  General  Lighting  System  Model 

The  model  used  to  define  airfield  lighting  systems  (Figure  1)  consists 
of  12  components;  commercial  power,  auxiliary  power,  control  panel,  con- 
trol circuitry,  control  vault,  regulator,  primary  cable,  isolating  trans- 
former, secondary  cable,  fixture,  lens,  and  lamp.  Division  of  the  model 
into  components  considered  function,  maintenance,  physical  proximity  and 
connection,  and  failure  mode.  Some  of  the  components  include  several  ele- 
ments (e.g.,  the  control  vault  includes  power  transformers,  relays,  switches, 
etc.)  while  others  are  composed  of  a single  element  (e.g.,  the  lamp).  A 
lighting  system  may  include  a variable  number  of  any  of  the  component  types. 

By  defining  component  operating  and  failure  rate  characteristics  and 
the  system  configuration  and  failure  criteria,  any  specific  airfield 
lighting  system  can  be  analyzed  using  this  general  model. 

Airfield  Lighting  System  Operation 

An  airfield  lighting  system  is  designed  to  operate  over  a design  life 
of  some  period,  typically  15  to  20  years.  Some  of  the  components,  however, 
are  designed  for  lives  considerably  shorter  than  the  system  design  life. 

Thus,  maintenance  is  critical  to  the  operation  of  airfield  lighting  systems. 
In  fact,  a recent  study  of  airfield  lighting  found  that  without  maintenance, 
total  deterioration  can  result  in  3 to  4 years.' 

Maintenance  performed  on  the  systems  is  either  corrective  or  preventive. 
Corrective  maintenance  entails  repairing  or  replacing  items  of  equipment 
which  have  failed.  Preventive  maintenance  includes  all  activities  per- 
formed prior  to  failure  which  ensure  reliable  operation  of  the  system.  The 
level  of  preventive  maintenance  and  the  speed  of  corrective  maintenance 
directly  influence  the  system's  capacity  to  serve  its  design  function. 

Since  airfield  lighting  systems  undergo  constant  maintenance,  their 
behavior  becomes  independent  of  the  starting  state  after  a period  of 


^Analysis  of  Genera!.  Aviation  Airports — Summary  Report  Task  III 

(Burns  and  McDonnell  Engineering  Company,  August  1974). 


Figure  1.  General  lighting  system  model . 
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operation.  In  this  condition,  a system  is  composed  of  equipment  of  various 
ages,  with  each  equipment  item  having  an  equal  probability  of  being  at  any 
point  in  its  design  life  at  a given  time.  This  condition  is  known  as  the 
steady  state. 

By  assuming  that  a lighting  system  is  operating  in  a steady  state,  the 
problem  of  analyzing  its  reliability  becomes  manageable.  Typical  component 
characteristics  and  failure  rates  can  be  estimated,  and  component  reliability 
distributions  can  be  determined  using  stochastic  techniques.  Proceeding  in 
this  manner,  the  reliability  of  a specific  system  can  be  evaluated  for  the 
conditions  under  which  it  operates. 

Airfield  Lighting  System  Failure 

An  airfield  lighting  system  fails  when  it  does  not  accurately  transmit 
the  information  required  by  a pilot  for  safe  operation  of  an  aircraft. 

System  failure  can  be  due  to  components  not  functioning  or  to  components 
operating  at  less  than  the  designed  condition  and  thereby  transmitting 
false  information  to  the  pilot.  Since  pilot  perception  is  involved,  system 
failure  is  subjective,  except  in  cases  where  the  majority  of  lights  are 
inoperable. 

To  provide  objectivity  to  the  failure  criteria,  the  FAA  has  established 
minimum  operating  standards  for  individual  lighting  systems.  Table  1 shows 
a sample  of  these  standards. 


Analysis  of  Reliability 

System  reliability  is  defined  as  the  probability  that  a system  will 
perform  its  intended  function  in  a specified  environment  for  a specified 
period  of  time.  The  steady-state  reliability  for  airfield  lighting  systems 
can  be  interpreted  as  the  probability  of  the  system  working  when  the  switch 
is  turned  on.  As  such,  reliability  cannot  be  directly  measured  but  must 
be  estimated.  Doing  so  requires  knowledge  of  the  following: 

a.  The  equipment  failure  process 

b.  The  equipment  characteristics  (including  operation,  geometry,  and 
maintenance) 

c.  The  state  in  which  the  system  is  defined  as  failed. 

System  reliability  is  thus  a combination  of  the  probabilities  of 
success  for  each  of  the  component  items  of  equipment.  In  a series  system 
such  as  the  general  lighting  model,  the  system  reliability  is  the  product 
of  the  component  reliabilities.  Since  the  component  reliabilities  are 
generally  less  than  1.0,  the  system  reliability  decreases  as  the  system 
becomes  more  complex  (i.e.,  as  more  components  are  added).  Defining  each 
component's  operation  as  accurately  as  possible  is  therefore  imperative. 

The  reliability  of  each  component  type  in  the  general  lighting  system 
model  can  be  approximated  by  an  exponential  distribution  over  the  component's 
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Table  1 


Typical  System  Failure  Criteria 


System 


ALSF  II 

Centerline  bars 


Si derow  bars 


Threshold  bar 


500- foot  (150-meter) 
bar 

1,000-foot  (300- 
meter)  bar 


Criteria 


Two  lamps  out  in  five-lamp  bar  constitutes  a 
bar  failure. 

Two  consecutive  light  bars  failed  or  20  per- 
cent random  outages  constitutes  system  failure. 

One  lamp  out  in  three-lamp  bar  constitutes  a 
bar  failure. 

Two  consecutive  light  bars  failed  or  20  per- 
cent random  outages  constitutes  system  failure. 

Three  adjacent  lights  or  20  percent  random 
failures  constitutes  system  failure. 

Same  as  threshold. 


Same  as  threshold. 


Category  II 

Centerline  lights  Four  consecutive  outages  or  10  percent  random 

failures  constitutes  system  failure. 

Touchdown  zone  Two  consecutive  bar  failures  or  10  percent 

random  failures  on  either  side  of  the  center- 
line  constitutes  system  failure. 
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design  life  (Figure  2).  Since  component  reliability  is  a function  of  the 
component's  failure  rate,  and  since  measurement  of  the  failure  rate  is  more 
practical  than  direct  measurement  of  reliability,  the  reliability  distribu- 
tion in  Figure  2 is  normally  determined  as  a function  of  failure  rate,  as 
shown  in  Eq  1. 

R(t)  = e'^^  [Eq  1] 

where  R(t)  = the  component  reliability  at  time  t 
X = the  component  failure  rate 


>- 


ffi 

< 


Ui 

oc 


Figure  2.  Reliability  distribution. 


Determination  of  the  failure  rate  (X)  for  each  component  in  the  sys- 
tem is  quite  complex  when  maintenance  and  operation  practices  are  con- 
sidered. Full-scale  testing  of  lighting  systems  to  determine  failure  rates 
would  be  expensive  and  time  consuming,  while  accelerated  testing  of  sys- 
tems or  individual  components  introduces  inaccuracies.  Thus,  field  data  on 
system  performance  are  the  best  source  of  information  for  determining  a 
component's  reliability  function. 

Considering  the  field  data  anticipated  to  be  available,  the  relia- 
bility function  for  each  component  in  the  lighting  system  can  be  expressed 
by 

R(t)  ■ e [Eq  2] 

where  = the  coefficient  of  failure 

C = the  coefficient  of  maintenance 
m 

t = the  safety  time  (i.e.,  the  period  of  time  when  the  component 
is  known  to  have  no  chance  of  failure). 
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This  expression  empirically  accounts  for  preventive  maintenance,  corrective 
maintenance,  and  failure  rate.  Preventive  maintenance  (PM)  considers  the 
component's  design  life,  replacement  time  (i.e.,  that  period  preceding  the 
design  life  when  group  replacement  is  undertaken),  and,  indirectly,  the 
level  of  PM  activities  (i.e.,  the  more  PM  performed,  the  lower  the  failure 
rate).  Corrective  maintenance  includes  the  time  to  detect  a failure  and 
the  time  required  to  perform  repairs.  The  failure  rate  is  the  annual  num- 
ber of  failures  to  that  component  type  in  a system  due  to  all  failure  modes 
(e.g.,  wear-out,  human  error,  etc.).  Appendix  B describes  the  determination 
of  component  reliability  and  definition  of  the  variables  involved. 

Once  the  individual  component  reliabilities  have  been  determined,  they 
can  be  combined  to  determine  the  average  unit  reliability.  The  unit  relia- 
bility (Ry)  is  defined  as  the  probability  that  a randomly  chosen  single 
unit  in  the  system  will  be  operational  when  called  upon  to  perform.  The 
unit  is  composed  of  one  of  each  component  type  in  the  general  lighting  model. 
Equation  3 is  used  to  compute  from  the  component  reliabilities. 

Ru  = {l  - [l-R^ (t^ )][1-R2(t2)]|  • ^3(^3)  • R4(t4)  • R5(t5)  • 

* *^10^^10^  ’ *^11^^11^  ’ ^12^^12^ 

where  R^  = unit  reliability 

Rj(t^)  = the  reliability  of  component  i as  a function  of  its  time  in 
service  (t)  where  i indicates  components  1 through  12  in  the 
general  model . 

In  evaluating  the  average  unit  reliability,  it  must  be  considered  that 
the  component's  reliability  is  actually  a function  of  time  and  that  in  the 
steady-state,  the  component's  reliability  can  be  at  any  point  of  time  on 
the  function.  The  system  geometry  or  the  number  of  each  component  type  in 
the  system  must  also  be  considered.  A Monte  Carlo  simulation  routine  was 
developed  to  stochastically  account  for  these  factors.  Appendix  B includes 
this  routine  along  with  further  information  on  unit  reliability. 

From  the  average  unit  reliability  and  the  system  failure  criteria, 
the  reliability  of  the  lighting  system  can  be  determined  from  the  following 
equation: 

R = I W.r"'^1-R  )’  [Eq  4] 

where  R^  = the  system  reliability 
R^  = the  unit  reliability 
n = the  total  number  of  lights  in  the  system 
i = the  number  of  light  failures  in  the  system 
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W^.  = the  number  of  ways  i failures  can  occur  in  a system  of  n total 
lights  without  the  system  reaching  failure  by  either  the  random 
or  the  consecutive  failure  criteria. 


Appendix  B includes  a comprehensive  description  of  the  analytical  pro- 
cedure used  to  determine  R^. 


Computerized  Procedure 

The  reliability  methodology  summarized  in  the  previous  section  was  in- 
corporated in  an  automated  program  capable  of  estimating  the  functional 
reliability  of  any  lighti^^g  system  used  in  the  visual  guidance  of  aircraft. 
This  program,  called  RAALS  (Reliability  Analysis  of  Airfield  Lighting  Sys- 
tems), can  be  efficiently  used  by  airport  managers,  governing  agencies,  or 
maintenance  personnel  interested  in  determining  airfield  lighting  system 
reliability.  The  analytical  techniques  developed  can  also  be  modified  to 
evaluate  the  reliability  of  any  complex  system  for  which  failure  criteria 
stipulate  consecutive  failures  as  well  as  random  failures. 


17 


3 FINDINGS 


RAALS  Program 

The  automated  procedure  for  analyzing  airfield  lighting  system  relia- 
bility developed  in  this  study  is  an  implementable  tool  which  can  be  used 
to: 


a.  Compare  the  reliability  of  similar  systems  at  various  airports 

b.  Determine  where  a system  should  be  improved  to  increase  its 
rel iabil ity 

c.  Form  a basis  for  decisions  on  implementing  changes  to  failure 
criteria,  equipment,  or  maintenance  policies 

d.  Monitor  the  reliability  of  a system  as  it  becomes  older  or  as 
modifications  are  installed. 

Presently,  the  RAALS  program  is  operating  on  the  CDC  6600  series  computer, 
but  the  user  can  modify  it  to  operate  on  other  hardware. 

RAALS  Input 

The  input  data  necessary  to  evaluate  a system's  reliability  with  the 
RAALS  program  include: 

a.  The  number  of  each  type  of  component  in  the  system  (i.e.,  the 
system  geometry) 

b.  The  number  of  failures  per  year  for  each  type  of  component 

c.  The  design  life  for  each  type  of  component 

d.  The  safety  time  for  each  component  (i.e.,  the  period  following 
installation  when  the  reliability  is  1.0) 

e.  The  replacement  time  for  each  component  (i.e.,  the  period  of  time 
the  component  is  expected  to  be  operational) 

f.  The  operation  criteria  in  hours  per  day  and  days  per  year 

g.  The  system  failure  criteria. 

RAALS  Logic 

The  RAALS  program  logic  is  based  on  traditional  reliability  theory. 
However,  due  to  the  number  and  complexity  of  lighting  systems  and  the 
necessity  to  consider  consecutiveness  in  the  failure  criteria,  original 
analytical  techniques  were  developed  and  interfaced  with  traditional  theory. 
These  techniques  included: 
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a.  Formulation  of  a general  lighting  system  model  capable  of  consider- 
ing all  of  the  diverse  equipment  and  geometry  encountered  in  airfield  light- 
ing 


b.  Adaptation  of  a Monte  Carlo  simulation  routine  to  the  analysis  to 
account  for  the  stochastic  nature  of  the  component  reliabilities 

c.  Derivation  of  the  consecutive  coefficient  to  consider  consecutive- 
ness in  the  system  failure  criteria  (see  Appendix  C) 

d.  Development  of  an  analytical  procedure  to  determine  system  relia- 
bility which  accounts  for  the  operation,  maintenance,  and  failure  variables 
of  each  component 

e.  Automation  of  the  combined  procedures  into  a concise,  efficient 
computer  program. 

Appendix  D provides  the  program  documentation  and  an  example  problem. 


Field  Investigation 

Maying  reliability  evaluations  for  any  system  requires  knowledge  of  the 
failure  rate  of  the  component  equipment  in  the  system.  This  knowledge  re- 
quires constant  orderly  feedback  of  information  from  the  field.  A limited 
field  investigation  was  conducted  to  determine  what  types  of  information  are 
presently  being  collected.  It  was  anticipated  that  present  maintenance 
records  could  be  analyzed  with  the  RAALS  program  to  predict  the  reliability 
of  existing  lighting  systems. 

The  FAA  maintains  the  Visual  Approach  Slope  Indicator  (VASI)  and  the 
lighting  systems  in  front  of  the  runway  thresholds  while  individual  airport 
agencies  maintain  all  other  systems.  Both  the  FAA  and  airport  maintenance 
staffs  keep  maintenance  logs  on  performance  checks,  corrective  repairs,  and 
preventive  maintenance.  However,  the  data  examined  during  the  field  in- 
vestigation were  sparse.  The  logs  being  kept  did  not  provide  all  the  input 
data  needed  for  the  reliability  analysis.  Based  on  discussions  with  field 
personnel,  however,  the  missing  data  were  estimated  subjectively.  These 
data  were  used  as  the  basis  for  the  example  problem  in  Appendix  D and  the 
sensitivity  analysis  in  Appendix  E.  Since  historical  records  of  component 
failures  were  limited,  further  analysis  of  field  data  was  not  undertaken. 

The  following  observations  can  be  made  based  on  the  field  investigation: 

a.  FAA  records  are  standardized,  while  each  airport  maintenance  staff 
develops  its  own  format  for  record-keeping.  Thus,  for  a reliability  analy- 
sis procedure  to  be  universally  implementable,  standardized  maintenance 
record-keeping  should  be  initiated.  Otherwise,  the  data  on  each  individual 
system  must  be  manipulated  to  fit  the  reliability  analysis  procedure's  format. 
This  will  entail  subjective  judgments  which  will  introduce  ambiguities  in 
the  comparison  of  lighting  systems  at  different  sites. 
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b.  Recording  of  maintenance  data  is  hampered  by  several  factors. 
Maintenance  personnel  often  feel  they  barely  have  time  to  keep  up  with  cur- 
rent corrective  repair  activities  and  therefore  have  little  time  for  ex- 
tensive record-keeping.  Since  some  failures  are  recorded  prior  to  determi- 
nation of  the  cause,  the  records  may  show  a light  out  when  the  failure  was 
actually  in  the  isolating  transformer  or  some  other  component.  In  addition, 
when  some  failures  are  corrected,  the  maintenance  personnel  make  no  record 
of  the  occurrence  because  it  was  not  considered  critical  or  because  they 
feel  a record  of  numerous  failures  would  adversely  affect  the  staff  per- 
formance rating. 

c.  Both  FAA  and  airport  maintenance  staffs  generally  believe  that 
their  lighting  systems  are  reliable.  Because  of  this  belief,  field  person- 
nel feel  that  recording  supportive  data  is  an  unnecessary  burden. 


Sensitivity  Analysis 

A sensitivity  analysis  of  the  variables  affecting  the  reliability  of 
lighting  systems  was  performed  using  the  RAALS  program.  The  results  pre- 
sented in  this  section  are  aimed  at  answering  typical  menagement  questions 
regarding  system  reliability.  Appendix  E contains  a detailed  discussion 
of  the  sensitivity  analysis. 

Failure  Criteria 

A lighting  system's  reliability  is  based  on  the  failure  criteria  used. 
The  failure  criteria  are  stipulated  as  a percentage  of  random  failures  and 
a number  of  consecutive  failures.  Relaxing  either  criterion  increases 
system  reliability. 

Since  the  relationship  between  the  failure  criteria  and  system  relia- 
bility is  not  linear,  only  trends  can  be  used  to  illustrate  the  sensitivity. 
Figure  3 shows  the  effect  of  relaxing  the  percentage  of  random  failures 
while  Figure  4 shows  the  effect  of  relaxing  the  number  of  consecutive  fail- 
ures. In  general,  the  random  failure  criterion  governs  when  the  consecutive 
failures  allowed  are  greater  than  5 and  random  failures  are  less  than  25 
percent.  Conversely,  when  the  consecutive  criterion  is  less  than  3,  it 
generally  governs. 

This  discussion  is  of  course  not  an  argument  to  relax  the  failure 
criteria  in  order  to  improve  reliability.  Minimum  information  conveyance 
standards  must  be  established  for  each  system  based  on  pilot  perception. 
However,  these  trends  do  illustrate  the  effect  on  system  reliability  should 
changes  in  the  failure  criteria  be  justified. 

Unit  Reliability 

Figure  5 shows  the  relationship  between  unit  reliability  and  system 
reliability  for  a standard  set  of  operating  characteristics  and  failure 
criteria.  As  the  figure  shows,  when  system  reliability  is  low  (Rs  less  than 
.96),  a small  increase  in  unit  reliability  results  in  a large  improvement 
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SYSTEM  RELIABILITY,  R, 


Where  NC  = Number  of 
Consecutive  Outages 
Allowed  in  the  System 


RANDOM  OUTAGES  (NR) 

Figure  3.  Random  failure  criterion  (low  data  set) 
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Where  NR  = Percent  Randon) 
Outages  Allowed  in  the  System 


in  system  reliability.  For  example,  improving  unit  reliability  by  .01  (from 
.95  to  .96)  results  in  a system  reliability  increase  of  .22  (from  .54  to  .76). 
However,  when  system  reliability  is  high,  increases  in  unit  reliability  are 
much  less  significant. 

Although  unit  reliability  can  be  used  to  illustrate  the  sensitivity  of 
system  reliability  from  an  analytical  standpoint,  it  cannot  be  used  as  a 
sole  measure  of  merit  for  improvements  to  the  system  because  numerous  vari- 
ables influence  R,j.  Some  of  these  variables  can  be  controlled  while  others 
cannot;  the  following  sections  discuss  the  sensitivity  of  R to  some  of  the 
controllable  variables. 

Group  Replacement 

Group  replacement  is  a preventive  maintenance  practice  involving  re- 
placement of  all  components  of  a particular  type  at  a specified  time  prior 
to  the  component's  design  life.  Group  -"eplacement  of  a component  will  im- 
prove the  reliability  of  that  component,  thereby  increasing  unit  and  system 
reliability.  Typically,  the  lamp  component  is  considered  for  group  replace- 
ment. Table  2 shows  the  effect  of  group  relampment  at  70,  80,  90,  and  100 
percent  of  the  lamp's  design  life  for  two  systems.  For  a standard  center- 
line  runway  system  (data  set  1),  group  relampment  provides  only  a small 
improvement.  For  a second  system  with  lower  reliability  (data  set  2),  the 
effect  is  more  pronounced. 

A second  component  for  which  replacement  time  could  be  considered  is 

the  lens.  Here,  rather  than  total  replacement  of  the  lenses,  group  cleaning 

or  restoration  is  considered.  The  effect  of  group  lens  restoration  at  one- 

half  of  the  design  life  is  given  in  Table  2.  Again,  the  effect  is  small 

when  the  original  system  reliability  is  high,  and  becomes  more  pronounced  as 

R decreases, 
s 


Table  2 

Effect  of  Group  Replacement 


Replacement  Time 

Case 

1 

Case 

2 

as  Percent  of 

Rj 

Rs 

Rs 

Rs 

Design  Life 

(Data  Set  1 ) 

(Data  Set  2) 

(Data  Set  1 ) 

(Data  Set 

70 

.99940 

. 98534 

. 99942 

.98576 

80 

.99939 

.98520 

.99941 

.98559 

90 

.99938 

.98501 

. 99940 

. 98524 

100 

.99937 

.98471 

.99939 

. 98488 

Case  1:  Replacement  time  of  lamp  varied  with  lens  replacement  time 
equal  to  design  life. 

Case  2:  Replacemerft  time  of  lamp  varied  with  lens  replacement  time 
equal  to  one-half  design  life. 
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Downtime 


Corrective  maintenance  activities  are  considered  in  the  analysis  using 
the  downtime  variable.  Downtime  is  defined  as  the  average  length  of  time 
a component  is  inoperable  following  failure.  Four  points  in  time  are  in- 
cluded in  the  downtime:  time  of  failure,  time  of  detection,  time  of  removal 
of  the  system  from  operation,  and  time  of  repair  or  replacement.  These 
points  are  illustrated  in  Figure  6.  If  the  component  failure  does  not 
constitute  system  failure,  the  time  of  removal  of  the  system  from  operation 

does  not  occur  (T^  = T ) . 

0 c 


fA!LEP__ 


COMPONENT 

DOWNTIME 


Tf  Td  ^0  "^c 


TIME 


where  T, 


time  of  failure 

time  of  detection 

time  system  removed  from  service 

time  failure  is  corrected 


Figure  6.  Periods  within  component  downtime. 


Table  3 presents  system  reliability  data  resulting  from  changes  in  the 
downtime  for  the  stated  reasons. 

Full  monitoring  of  a lighting  system  would  result  in  Tj  equal  to  Tf, 
which  would  decrease  the  downtime  for  all  components.  Assuming  a decrease 
in  the  downtimes  of  20  percent  for  all  components  would  result  in  an  in- 
crease of  .000282  in  the  system  reliability  for  this  data  set. 

If  maintenance  activities  were  either  increased  or  decreased,  the 
system  reliability  would  be  affected  as  shown  in  Table  3.  Note  that  de- 
creasing the  downtime  for  all  components  by  50  percent  results  in  an  in- 
crease in  Rj  of  .000585,  while  an  increase  of  50  percent  results  in  a de- 
crease in  of  .008238. 

Changing  the  frequency  of  checking  light  operation  and  replacement  of 
failures  from  daily  (every  12  hours)  to  evei^y  hour  during  the  operating 
period  would  improve  system  reliability  by  .000108,  while  changing  to  every 
other  day  (every  24  hours)  would  decrease  it  by  .00140. 
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Table  3 


Downtime  vs.  System  Reliability 


Reason 

Change  in  Downtime 

'^s 

Standard  data  set 

.999395 

System  monitored 

-20%  all  components 

.999677 

Maintenance  activity  increased 

-50%  all  components 

.999980 

Maintenance  activity  decreased 

+50%  all  components 

.991157 

Performance  check  of  lights 

--replaced  each  hour 

Tp  (Lamp)  = 1 

.999503 

--replaced  every  12  hours 

Tp  (Lamp)  = 12 

.999395 

--replaced  every  24  hours 

Tp  (Lamp)  = 24 

.999255 

Failure  Rate 

Table  4 indicates  the  sensitivity  of  system  reliability  to  changes  in 
the  failure  rate  of  the  lamp,  isolating  transformer,  and  regulator  components. 
These  types  of  changes  could  result  from  an  inferior  shipment  of  equipment 
or  from  exposure  to  atypical  weather  conditions  (e.g.,  electrical  storms) 
which  create  an  increased  number  of  failures. 
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Table  4 


Failure  Rate  vs.  System  Reliability 


Component 

Number  of  Failures  per  Year 

Lamp 

75 

.999455 

Lamp 

150 

.999395 

Lamp 

250 

.999306 

Isolating  transformer 

0 

.999419 

Isolating  transformer 

15 

.999395 

Isolating  transformer 

30 

. 999367 

Regulator 

0 

.999507 

Regulator 

3 

.999395 

Regulator 

9 

.999103 
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4 CONCLUSION 


The  automated  tool  produced  in  this  research  can  be  used  to  evaluate 
the  functional  reliability  of  any  airfield  lighting  system.  This  computer 
program,  RAALS,  includes  the  necessary  analytical  procedures  for  determin- 
ing reliability  in  an  efficient,  economical  manner.  The  program  output 
can  be  used  directly  by  the  FAA  or  any  airport  agency  to  measure  the  merit 
of  individual  systems  and  the  effectiveness  of  maintenance  activities. 

Testing  of  the  RAALS  program  did  not  indicate  a need  for  modification 
in  equipment  or  operation  to  any  of  the  lighting  systems  examined.  However, 
improved  and  standardized  maintenance  recordkeeping  procedures  for  all 
lighting  systems  are  needed.  Efficient  collection,  analysis,  and  reporting 
of  performance  data  will  aid  in  improving  lighting  system  reliability  by 
indicating  where  problems  exist  and  where  maintenance  activities,  both  cor- 
rective and  preventive,  should  be  increased  to  optimize  the  cost-benefit 
ratio. 


APPENDIX  A: 


VISUAL  GUIDANCE  LIGHTING  SYSTEMS 


System  Characteristics 

Aircraft  movements  are  guided  by  numerous  lighting  systems,  each  of 
which  is  designed  for  a specific  purpose;  that  is,  each  conveys  certain  re- 
quired information  to  the  pilot.  Thus,  the  geometry,  number  of  lights,  and 
individual  equipment  items  vary  depending  on  the  information  to  be  con- 
veyed by  the  system.  In  addition  to  these  physical  differences,  each 
lighting  system  also  has  unique  failure  criteria.  These  criteria  subject- 
ively establish  minimum  operating  standards  for  each  system  to  achieve  its 
designed  purpose. 

The  principal  lighting  systems  governing  aircraft  movements  are: 

a.  Approach  lights 

b.  Vertical  Approach  Slope  Indicators  (VASI) 

c.  Threshold  lights 

d.  Touchdown  lights 

e.  Runway  edge  lights 

f.  Runway  centerline  lights 

g.  Taxiway  edge  lights 

h.  Taxiway  centerline  lights. 

In  addition,  rotating  beacons,  runway  identification  lights,  obstruc- 
tion lights,  apron  lighting,  and  special  site-specific  lighting  (e.g., 
displaced  threshold)  also  aid  in  the  safe,  efficient  movement  of  aircraft. 

Figures  A1  through  A5  illustrate  typical  geometric  configurations  for 
the  principal  types  of  lighting  systems.  Although  the  number  of  lights 
varies  widely,  the  configuration  of  each  system's  lights  can  be  categorized 
as  either  linear  or  bar. 

Linear  systems  contain  a string  of  single  lights.  The  threshold, 
centerline,  edge,  and  approach  sequenced  flasher  lighting  systems  fall  into 
this  category.  Failure  criteria  for  this  category  are  typically  stated  as 
the  percent  of  random  outages  causing  system  failure  and  the  number  of  con- 
secutive outages  causing  system  failure. 

Bar  systems  contain  groups  of  lights  arranged  in  light  bars.  The  VASI 
and  the  wing,  centerline,  500-ft  (150-m),  1000-ft  (300-m),  and  terminating 
bars  of  the  approach  and  touchdown  zone  light  systems  are  included  in  this 
category.  The  failure  criteria  for  this  category  typically  include  the  per- 
cent of  random  outages  causing  system  failure,  the  number  of  consecutive 
bar  failures  causing  system  failure,  and  the  number  of  outages  in  a bar 
causing  bar  fai lure. 


29 


ALSF-I  ALSF-II  SSALSF  SSALSR  MALSF  MALSR  LDIN  REIL  VASI-4  VASI-12 


3000  ft 

30  LIGHT  BARS  EQUALLY  SWXCED  AT  lOO'  INTERVALS 
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2 THE  SPACING  BETWEEN  THE  INNERMOST  TOUCHDOWN  ZONE  LIGHT  FIXTURES  SHOULD  BE  UNIFORM  THROUGHOUT 
THE  LENGTH  OF  THE  SYSTEM.  THIS  SPACING  IS  72ft  EXCEPT  WHERE  CONSTRUCTION  PROBLEMS  PREVENT  THIS 
SEPARATION  IN  THIS  CASE  THE  UNIFORM  SPACING  IS  REDUCED  TO  NOT  LESS  THAN  65  ft. 

Figure  A2.  Touchdown  zone  light  configuration.  SI  conversion  factor;  1 ft  = 0.3048  m. 


»ee  eee  I e«ee~eeee 


APPLICATION  OF  SINGLE  ELEVATED  LIGHTS  AND  SEMIFLUSH  LIGHTS 


LEQENO^ 


# — 360®  WHITE,  EXCEPT  FOR  THE  LAST  2,000ff  OF  THE  INSTRUMENT  RUNWAY 
RCG--RED  ISO®  AND  GREEN  180® 

^ — SEMIFLUSH  FIXTURE  BIDIRECTIONAL 


note-  six  threshold  lights  used  on  non- INSTRUMENT  RUNWAYS 
EIGHT  THRESHOLD  LIGHTS  USED  ON  INSTRUMENT  RUNWAYS 

Figure  A3.  Typical  high-intensity  runway  edge  light  (HIRl.) 

configuration.  SI  conversion  factor;  1 ft  = 
0.3048  m. 
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cal  taxiway  edge  lighting  configuration.  SI  conversion  factor: 


General  Lighting  System  Model 


Although  the  systems  discussed  above  have  different  configurations, 
number  of  lights,  and  failure  criteria,  all  require  a power  source,  elec- 
trical circuitry,  and  elements  for  light  dispersion.  Because  of  these 
similar  requirements,  a general  lighting  system  model  can  be  developed 
which  is  sufficiently  flexible  to  account  for  the  physical  and  failure 
criteria  differences.  Figure  A6  shows  the  general  model  adopted  for  analyz- 
ing system  reliability,  this  model,  which  has  been  divided  into  12  com- 
ponents, can  be  used  to  describe  all  the  linear  and  bar  lighting  systems. 
Figure  A7  illustrates  the  model  components  as  applied  to  the  runway  center- 
line  system. 

Division  of  the  general  lighting  system  into  components  considered 
function,  maintenance  records  and  practices,  physical  proximity  and  con- 
nection, and  equipment  failure  modes.  Some  of  the  12  components  are 
composed  of  a single  element  (e.g.,  lamp),  while  others  include  several 
elements  (e.g.,  the  control  vault  includes  transformers,  relays,  time 
switches,  meters,  etc.). 

Using  this  model,  the  operation  of  any  airfield  lighting  system  can  be 
defined  by  the  characteristics  of  each  of  the  12  components,  the  system 
geometry,  and  the  system  failure  criteria. 


Component  Characteristics 

Typical  failure  modes  and  their  significance  to  system  operation  are 
defined  in  Table  A1  for  each  of  the  12  components  in  the  general  lighting 
system  model.  A single  failure  in  any  of  the  equipment  in  the  first  seven 
components  normally  constitutes  a system  failure.  However,  multiple 
failures  of  the  remaining  components  are  required  before  the  system  is 
classified  as  failed.  To  characterize  the  components  in  a specific  system, 
the  total  number  of  these  failures  and  other  operational  data  must  be  de- 
fined. Table  A2  tabulates  the  data  necessary  to  characterize  each  component. 


Maintenance 

The  general  model  depicts  an  airfield  lighting  system  as  an  arrange- 
ment of  12  types  of  components,  with  variable  numbers  of  each  component. 

The  design  lives  of  the  component  types  are  not  identical,  and  are  generally 
less  than  the  system's  design  life.  In  addition,  every  component  in  the 
system  does  not  operate  over  its  entire  design  life,  but  fails  with  some 
frequency  distribution  over  time.  Figure  A8  shows  a typical  failure  dis- 
tribution. This  distribution  provides  the  proportion  of  the  total  initial 
number  of  a component  type  which  will  be  operating  at  any  given  time  in 
the  design  life,  or  the  probability  of  a component  operating  at  a given 
time.  Combining  all  the  considerations  discussed  above  results  in  a set 
of  operation  curves,  as  shown  in  Figure  A9  for  the  general  lighting  system 
model . 
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Figure  A7.  Runway  centerline  lighting  system.  SI  conversion  factor- 
1 ft  = 0.3048  m. 


Typical  Component  Failure  Data 


Component  Equipment  Failure  Modes  Failure  Significance 
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Secondary 
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Figure  A8.  Typical  failure  distribution  for  a 
single  component  type. 


As  Figure  A9  shows,  for  a lighting  system  to  function  over  its  intended 
design  life,  periodic  repair  and  replacement  of  components  is  necessary. 
Thus,  after  a period  of  operation,  the  lighting  system  is  comprised  of  equip 
ment  items  of  varied  ages,  and  its  behavior  becomes  independent  of  its  start 
ing  state.  This  condition  is  known  as  the  steady  state  in  which  at  any 
given  time,  a component  may  be  considered  at  any  stage  in  its  design  life 
with  equal  probability. 

The  steady  state  which  a lighting  system  reaches  depends  on  the  main- 
tenance performed  on  the  system.  This  maintenance  takes  two  forms:  pre- 
ventive and  corrective.  Preventive  maintenance  includes  those  activities 
performed  while  the  component  equipment  is  in  service  to  prevent  deteriora- 
tion and  ensure  reliable  operation.  The  level  of  preventive  maintenance 
performed  is  reflected  in  the  equipment's  failure  distribution.  Corrective 
maintenance  encompasses  the  repair  or  replacement  of  defective  components. 

Because  the  airfield  lighting  systems  are  maintained  systems,  analysis 
of  their  reliability  is  complicated  by  interactions  among  the  diverse  system 
and  component  characteristics.  Appendix  B presents  the  methodology  used  to 
account  for  these  interactions  in  evaluating  the  system  reliability. 
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APPENDIX  B: 


THE  SYSTEM  RELIABILITY  MODEL 


General  Reliability  Theory 

Reliability  can  be  defined  as  the  probability  that  an  item  of  equip- 
ment (or  device  or  system)  will  perform  satisfactorily  for  a specified 
period  of  time  when  used  in  a specified  environment.  Estimating  reliability 
requires  knowledge  of  the  following: 

a.  The  state  in  which  the  equipment  and/or  system  is  defined  as 
failed  (the  system  failure  criteria) 

b.  The  equipment  failure  process,  normally  given  as  a stochastic 
relationship  of  failure  distribution  with  time 


c.  The  equipment  and/or  system  characteristics  which  describe  geome- 
try, operation,  and  maintenance. 


Reliability  of  Single  Equipment 


The  reliability  of  a set  of 


where  R(t)  = reliability  at  time 

Ns  = number  of  equipment 

No  = number  of  equipment 
period  t. 


identical  equipment  can  be  expressed  as 
R(t)  = ^ [Eq  Bl] 

period  t 

items  surviving  time  period  t 

items  operating  at  the  beginning  of  time 


Thus,  the  distribution  of  reliability  with  respect  to  time  is  a function  of 
the  equipment  failure  rate  or  of  the  rate  of  change  of  the  operable  equip- 
ment to  the  total  number  of  beginning  equipment. 


The  equipment  failure  rate  depends  on  such  factors  as  the  age  of  the 
equipment  and  the  manner  in  which  it  is  used  and  maintained.  A typical 
equipment  failure  cycle  (Figure  Bl ) includes  three  time  periods:  infant 
mortality,  normal  operating,  and  wear-out.  The  infant  mortality  and  wear- 
out  periods  are  significant  for  newly  designed  equipment  which  requires 
debugging  and  has  no  established  design  life.  The  normal  operating  period 
of  commercial  equipment  or  systems  is  the  time  during  which  reliability  is 
usually  desired.  As  shown  in  Figure  Bl , the  failure  rate  during  the  normal 
operating  period  is  constant.  For  the  constant  failure  rate,  the  reliability 
function  with  respect  to  time  can  be  described  as  a negative  exponential 
distribution  expressed  by 

R(t)  = e"'^^  [Eq  B2] 
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FAILURE  RATE 


Figure  B2  illustrates  this  distribution. 


Figure  Bl.  Typical  equipment  failure 
cycle. 


Figure  B2.  Typical  reliability 
function. 


For  a given  item  of  equipment,  determination  of  the  failure  rate  (A) 
can  be  complex.  When  the  equipment  also  undergoes  maintenance  and  replace- 
ment during  an  operating  period,  that  determination  becomes  even  more 
complex. 

Reliability  of  Conneated  Equipment 

Since  the  reliability  of  a system  of  interconnected  equipment  items 
is  usually  more  significant  to  the  user  than  the  individual  reliabilities, 
techniques  for  combining  the  individual  component  reliabilities  are  neces- 
sary. In  general,  a system  is  composed  of  equipment  linked  in  series, 
parallel,  or  a combination  of  the  two. 

Figure  B3  illustrates  a series  system.  The  system  reliability  of  this 
arrangement  is  given  by  the  product  of  the  individual  reliabilities  or 

Rs  = Ri  • ^2 

Note;  System  failure  occurs  if  any  one  of  the  n items  of  equipment  fail. 


• • • • 


OH— 


Figure  B3.  Series  system. 
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Figure  B4  presents  a special  case  of  a series  system  which  includes  a 
standby  redundant  component.  That  is,  when  component  1 fails,  a switch, 
which  is  assumed  to  never  fail,  is  closed  and  component  la  completes  the 
series.  The  system  reliability  for  this  case  is 


Rs  = R3 


n • 1 - (1-Ri)  (1-Ria) 


[Eq  B4] 


Note:  System  failure  occurs  if  any  one  of  the  2 to  n components  fails  or 
if  both  1 and  la  fail . 


CO 1 3 }—•»»— I n I — o 


Figure  B4.  Series  system  with  standby  redundant  component. 


Figure  B5  illustrates  a parallel  system  whose  reliability  is  expressed 
by 

R = 1 - n (1-R.)  [Eq  B5] 

^ i = l ’ 

where  IT  denotes  the  product  of  the  (1-R^)  terms. 

Note:  System  failure  occurs  only  when  all  of  the  n items  of  equipment  fail. 


Figure  B5.  Parallel  system. 


As  Eqs  B3,  B4,  and  B5  indicate,  the  probability  of  successful  operation 
of  the  system  depends  on  the  probability  that  all  component  equipment  in  the 
system  operates  successfully.  This  implies  that  the  greater  the  complexity 
of  the  system,  the  lower  the  system  reliability. 
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It  should  also  be  noted  that  the  component  reliability  terms  in  these 
equations  actually  represent  points  on  the  equipment's  reliability  function 
(Eq  B2).  Thus,  these  equations  are  time  dependent. 

Application  to  Lighting' System  Model 

The  basic  principles  presented  here  can  be  expanded  to  estimate  the 
system  reliability  of  the  general  lighting  model  presented  in  Appendix  A. 
Then,  by  defining  system  failure  criteria,  component  failure  processes,  and 
system  characteristics,  this  methodology  can  be  applied  to  determining  the 
reliability  of  specific  lighting  systems. 

The  procedure  for  determining  the  reliability  of  visual  guidance 
lighting  systems  basically  entails: 

a.  Determining  the  reliability  function  for  each  component 

b.  Combining  the  component  reliabilities  to  determine  the  unit  relia- 
bility, i.e.,  the  probability  that  a single  light  in  the  system  is  opera- 
tional 

c.  Determining  the  system  reliability  based  on  unit  reliability,  system 
geometry,  and  system  failure  criteria. 

Figure  B6  illustrates  the  interconnection  of  components  used  in  determining 
system  reliability  from  the  general  lighting  model. 

The  resultant  system  reliability  (Rg)  is  the  mean  instantaneous,  steady- 
state  reliability;  that  is,  the  value  of  Rs  is  time  independent.  As  des- 
cribed in  Appendix  A,  after  a period  of  operation,  a maintained  lighting 
system  reaches  a steady  state  in  which  the  component  reliability  can  be  at 
any  point  in  the  reliability  function  with  equal  probability.  Thus,  a mean 
unit  reliability  can  be  determined  after  sufficient  iterations  using 
randomly  selected  component  reliabilities.  By  iterating  through  this  pro- 
cedure, the  mean  system  reliability  can  be  determined  for  the  steady  state. 
The  steps  in  this  procedure  are  discussed  in  the  following  sections. 


Determination  of  Component  Reliability 


The  reliability  function  for  each  type  of  component  (Rci)  in  The  general 
lighting  system  can  be  estimated  using  Eq  B2.  However,  the  failure  rate 
term  (A)  must  be  determined  to  account  for  random  failures  of  the  equipment 
and  the  operation  and  maintenance  policies  under  which  the  system  functions. 
Eq  B6  was  derived  from  an  evaluation  of  the  factors  influencing  component 
reliability.  r 

-(t-tj 

/ ~"cT 


= e 


for 


t > 
r 


t > t. 


[Eq  B6] 


= 1 


for  t <.  t. 
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Figure  B6.  General  reliability  model. 


where  (t) 


the  reliability  of  the  ith  component  at  operating  time  t 


t = time  of  the  reliability  estimate 


= the  failure  coefficient 

c = the  maintenance  coefficient 
m 

t = the  safety  time  (i.e.,  the  time  after  installation,  t = 0, 
^ during  which  the  possibility  of  the  component  failing  is 
known  to  be  zero) 

t = the  replacement  time  (i.e.,  the  estimated  time  period  in 
which  the  component  is  expected  to  be  in  service). 


Description  of  each  variable  and  procedures  for  estimating  them  are 
given  below. 


The  Failuve  Coeffiaient  (Cj>) 

The  failure  coefficient  provides  a measure  of  the  random  failure  rate* 
of  the  component  due  to  all  failure  mechanisms.  Thus,  for  the  lamp  component, 
this  variable  accounts  for  failure  by  burn-out,  breakage,  vandalism,  in- 
tensity decrease,  or  any  other  mechanism. 

The  failure  coefficient  for  each  component  (C^. ) can  be  computed  from 
Eq  B7. 


__  (total,  no^  of  comjo_nent  i jn_:^e_jys^.^  5 0 37^ 

fi  'no.  of  component  i failures  per  year  ' ' l j 


In  this  relationship,  50,000  is  a constant  which  provides  the  proper  magni- 
tude to  the  failure  coefficient  for  use  with  the  reliability  function  of 
Eq  B6. 

The  total  number  of  component  i equipment  in  the  system  is  determined 
from  the  geometry  of  the  system  being  analyzed.  For  example,  the  system 
may  have  one  conmercial  power  source,  three  regulators,  150  lamps,  etc. 

The  number  of  failures  per  year  for  each  component  can  be  determined 
from  past  records,  data  from  a similar  system  in  a similar  environment,  or 
engineering  judgment.  It  should  be  noted  that  using  judgment  rather  than 
empirical  data  decreases  the  confidence  in  the  analytical  precision. 


*As  used  here,  random  failures  are  random  with  respect  to  time  of  occurrence. 
Failures  due  to  unassignable  causes  are  not  considered  to  be  random.  Only 
by  assuming  that  all  failures  have  a cause  (regardless  of  whether  the 
cause  is  presently  known)  can  the  failure  rate  be  analyzed  with  the  aim  of 
reducing  it  to  a tolerable  level. 
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'7he  '■laintenanae  Coeffiaisnt  (C  ) 

Figure  B7  shows  a two-lamp  system  in  which  one  outage  is  allowed  but 
two  outages  constitute  system  failure.  System  failure  occurred  when  lamps 
1 and  2 failed  at  the  same  time.  Had  the  downtime  (time  when  the  equip- 
ment is  inoperable  due  to  failure)  for  lamp  1 been  decreased  to  a point 
preceding  the  failure  of  lamp  2,  the  system  would  not  have  failed.  Thus, 
the  component  downtime  has  a direct  effect  on  the  system's  reliability. 


LAMP  I 
LAMP  2 


ofMrating  — 
foiled  — 

operating  — i 
failed  — ^ 


SYSTEM 


operating  — | pi 

failed  


r 


TIME 


Figure  B7.  Failure  of  a two-lamp  system. 


The  downtime  is  reflected  in  the  component  reliability  function,  since 
reliability  is  by  definition  a function  of  the  number  of  equipment  items 
out  of  the  total  equipment  in  the  system  operating  at  a given  time  (Eq  Bl). 

When  a component  fails,  four  points  in  time  determine  the  downtime; 

T^  = the  time  at  which  failure  occurs 

T.  = the  time  at  which  the  failure  is  detected 
d 

T = the  time  at  which  the  system  is  taken  out  of  service  due  to 
0 £ • 1 

fai lures 

T = the  time  at  which  the  failure  is  corrected  or  repaired, 
c 

Figure  B8  illustrates  these  points  in  time. 

I CX)MPONENT  . I 
r DOWNTIME  | 

FAILED 


Figure  B8.  Time  periods  determining  downtime. 
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The  component  downtime  (Tq)  is  equal  to  Tq  - Tf.  However,  if  the  sys- 
tem is  not  taken  out  of  service  by  a single  component  failure,  then  Tq 
equals  T(-  - T|:.  In  either  case,  the  downtime  is  composed  of  two  periods: 
time  from  failure  to  detection,  and  time  from  detection  to  repair  or  system 
shutdown. 

The  detection  time  for  critical  components  such  as  the  commercial 
power  can  be  nearly  instantaneous.  However,  for  other  components,  such  as 
lamps,  lenses,  etc.,  the  detection  time  depends  on  the  frequency  of  per- 
formance inspections. 

After  failure  detection,  the  remaining  downtime  is  a function  of  the 
time  necessary  to  repair  or  replace  the  component  (included  in  this  period 
is  the  time  to  troubleshoot  the  failure).  This  period  is  a function  of 
maintenance  (staff  available,  parts  in  stock,  accessibility  to  the  equip- 
ment, etc.).  When  the  system  is  taken  out  of  service,  the  downtime  after 
detection  is  determined  by  the  time  required  to  relieve  the  system  of  air- 
craft requiring  its  guidance. 

Since  the  downtime  is  a direct  function  of  maintenance  (inspection 
intervals  and  repair  time),  a maintenance  coefficient  was  introduced  to 
adjust  the  component  reliability  function  based  on  the  level  of  system 
maintenance.  The  maintenance  coefficient  is  computed  from 


where  C . 
ml 


R 


In(-C^.lnR) 

^mi  ~ ln{(t|^-t^)/2} 

the  maintenance  coefficient  for  the  ith  component 
the  failure  coefficient  for  the  ith  component 
the  component's  design  life 
the  component's  safety  time 

^f 

the  average  component  reliability  = 1 - (|^)(^) 


[Eq  B8] 


where 


'D 

T 


number  of  component  failures  per  year 
number  of  component  i in  the  system 
average  downtime  (hours) 

time  per  year  that  component  is  expected  to  be  operational 
(hours ) . 


Since  the  level  cf  preventive  maintenance  practiced  on  the  system  is 
reflected  in  the  number  of  failures  (N^),  the  maintenance  coefficient  also 
accounts  for  preventive  maintenance. 
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Sajet»  Tim<^  (t  J 
s 

The  safety  time  is  the  period  of  time  following  installation  during 
which  there  is  no  chance  of  the  component  failing  (i.e.,  R(t)  equals  1.5). 
This  period  of  time  can  be  estimated  from  empirical  failure  data  or 
manufacturer's  reliability  data.  If  this  type  of  information  is  not  avail- 
able, the  safety  time  should  be  assumed  to  be  zero;  that  is,  the  component 
has  a possibility  of  failing  at  any  time  following  installation. 

Revlaoenent  Time  (t  ) 
r> 

The  replacement  time  is  the  period  of  time  during  which  the  component 
is  in  service  --  from  installation  (t  equals  0)  to  replacement  (t  equals  t ). 
This  period  can  be  assumed  to  be  the  component's  design  life,  unless  the 
maintenance  policy  establishes  a standard  time  of  replacement.  For  example, 
if  a group  relampment  policy  is  enforced  at  80  percent  of  the  design  life 
of  lamps  rated  at  500  hours,  the  replacement  time  would  be  400  hours. 


Determination  of  Unit  Reliability 

Unit  reliability  (R^)  is  defined  as  the  probability  that  a randomly 
chosen  single  unit  in  a system  will  be  operational  when  called  upon  to 
perform.  The  unit  is  composed  of  one  of  each  component  type  in  the  system. 
For  the  general  airfield  lighting  system,  the  unit  is  one  branch  of  the 
system,  from  commercial  power  through  the  lamp  (see  Figure  86). 

Thus,  the  unit  is  a series  system  with  one  standby  redundant  component; 
its  reliability  can  be  determined  using  Eq  B4.  Since  each  component  relia-  " 
bility  is  actually  a function  of  time,  Eq  B4  can  be  written  as: 

Ru  = |l  - [1-R^(t^)][l-R2{t2)]|  • R3(t3)  • R4(t4)  * * 

[Eq  B9] 

Reltg)  • • Rg(tg)  • R9{tg)  * ' ^11^^11^  ' ’^12^^12^ 


In  determining  unit  reliability,  the  following  factors  must  be  con- 
sidered ; 

a.  Each  component's  reliability  is  represented  by  a reliability  dis-, 
tribution  over  time  rather  than  being  a constant. 

b.  The  system  is  assumed  to  be  in  a steady-state  condition,  i.e.,  at 
any  given  time,  a selected  component  may  be  at  any  point  in  its  design  life 
with  equal  probability. 

c.  The  system  geometry  (the  number  of  each  component  type)  will  in- 
fluence the  unit  reliability. 

A Monte  Carlo  simulation  routine  was  used  to  account  for  these  factors 
in  the  computation  of  unit  reliability.  Figure  B9  illustrates  this  procedure. 
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Perform  sufficient  iterations  to  calculate  the  mean 
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A simple  16-light  system  can  be  used  to  further  illustrate  this  pro- 
cedure. As  shown  in  Figure  BIO,  the  system  is  comprised  of  16  lamps,  lenses, 
fixtures,  secondary  cables,  and  isolating  transformers;  four  primary  cables; 
two  regulators;  and  one  control  vault,  control  circuit,  control  panel, 
auxiliary  power  source,  and  commercial  power  source.  This  configuration 
follows  the  general  lighting  model  presented  in  Appendix  A. 

Each  component  type  has  a reliability  function,  as  described  in  the 
previous  section.  For  the  lamp  component,  the  reliability  is  determined 
from  the  RLamp^*-)  function  for  16  randomly  selected  times  from  t equals  0 to 
t equals  lamp  replacement  time.  The  same  computation  is  performed  for  each 
component  type  in  the  circuit  back  to  the  isolating  transformer.  Different 
random  times  are  used  for  each  component  type.  Similarly,  four  random 
times  are  selected  for  the  primary  cable,  two  for  the  regulator,  and  one  for 
each  of  the  remaining  components.  The  result  is  an  array  of  component  re- 
liabilities which  is  a function  of  the  system  geometry.  A set  of  unit 
reliabilities  can  then  be  computed  as  follows: 


’^5,1^^5,1^  ‘ '^6,1^^6,1^  ’ '^7,1^^7,1^  ■ ’^8,1^^8,1^  ’ ’^9,1^^9,1^  ' 

^10,1  ^^10,1  ^ ■ ^12,1  ^^12,1  ^ 


*^0,16"  ■ ^^■'^1,1^^1,1^^I^^’'^2,1^^2,1^^}’^3,1^^3,1^  ‘ *^4, '^^4,1^  ' 

'^5,1^^5,1^  ’ ’^6,2^’^6,2^  ' ^7,4^^7,4^  ’ ^8,16^^8,16^  ' ^^9, 1 6^^9, 1 6^ 
'^10,16^^10,16^  ' ’^11,16^^11,16^  ' ’^12,16^^12,16^ 


From  this,  the  mean  unit  reliability  and  its  variance  can  be  calculated. 


Determination  of  System  Reliability 

Appendix  A categorizes  airfield  lighting  systems  as  either  linear  or 
bar  systems.  Because  the  failure  criteria  are  different  for  each  category, 
the  procedure  for  determining  the  system  reliability  also  differs. 

'>h\n‘  Suptrm  Rrliiibililu 

A linear  system  can  be  considered  as  a parallel  redundant  configura- 
tion of  n units  (lights).  The  mean  unit  reliability  from  the  preceding 
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Figure  BIO.  Unit  reliability  illustration. 


section  can  be  used  to  represent  the  steady-state  reliability  of  each  light. 
If  the  system  were  considered  failed  only  when  all  the  lights  failed,  the 
system  reliability  (R^)  would  be: 

R5  = 1 - d-Rj"  [Eq  BIO] 

However,  one  failure  criterion  for  linear  systems  stipulates  the  percentage 
of  random  outages  which  constitutes  system  failure.  For  this  criterion,  the 
system  reliability  conforms  to  the  binomial  distribution  or 


NR  „ • 

Rs  = n'i')R"''(l-R,,)’  [Eq  Bll] 

^ i=0  ^ u 

where  i = the  number  of  failures  in  the  system 

n = the  total  number  of  lights  in  the  system 

NR  = the  number  of  random  failures  allowed  in  the  system  (NR+1 
would  be  the  failure  criterion) 

R = unit  reliability  (the  probability  that  a single  typical  light 
will  be  operational ) 

(1*)  = the  number  of  ways  that  i outages  can  be  randomly  distributed 
in  n lights  with  the  system  not  being  in  a failed  state,  or  the 
factorial  expansion  of  n elements  taken  i at  a time 

f i 

The  second  failure  criterion  for  the  linear  system  stipulates  the  number 
of  consecutive  light  outages  which  constitute  system  failure.  Thus,  system 
reliability  is  a function  of  both  the  number  of  outages  and  their  location. 
Based  on  the  combined  failure  criteria,  the  reliability  of  a linear  system 
can  be  expressed  as: 

NR 

R = ).  WiR"'’(l-R  )’  [Eq  B12] 

where  = the  number  of  ways  that  i outages  can  be  distributed  among  n 
lights  with  the  system  remaining  in  a success  state. 


An  a priori  proof  of  Eq  B12  follows.  By  definition  R is  the  probability 
of  the  system  being  in  a success  state,  or  ^ 

R = y (Probability  of  i outages  occurring 
^s  with  the  system  in  a success  state) 


56 


The  failure  criteria  which  determine  if  the  system  is  in  a success  state 
involve  the  maximum  number  of  consecutive  failures  allowed  (NC)  and  the 
maximum  number  of  random  failures  allowed  (NR). 

The  failure  criteria  result  in  the  following  conditions: 

when  i = 0,...,  NC,  the  system  is  always  in  a success  state 

when  i = NC+1,...,  NR,  the  system  is  sometimes  in  a success  state 

when  i = NR+1,...,  n,  the  system  is  never  in  a success  state. 

Thus,  the  locations  of  the  i outages  must  be  considered  in  determining  the 
probability  of  system  success  when  i equals  NC+1,...,  NR.  The  system  re- 
liability can  then  be  expressed  as: 


R = y u . probability  of  the  i outages  occurring  in  a 
s * specific  sequence. 

If  the  probability  of  a lamp  being  in  a success  state  is  R^,  then  the  prob- 
ability of  i outages  occurring  in  n lamps  is  R[]'M1-Ru)’  and,  considering 
consecutiveness,  the  system  reliability  becomes: 


R = y W.  • r"'''(1-R 
1=0 

Note  that  when  i exceeds  the  random  outage  failure  criteria  (NR),  then 
equals  0. 

The  following  example  illustrates  this  model.  The  example  involves 
finding  the  system  reliability  for  a three-lamp  system  (n=3)  with  system 
failure  defined  as  all  three  lamps  out  or  two  consecutive  lamps  out.  The 
probability  of  a lamp  being  on  is  R^.  Table  B1  shows  the  eight  possible 
conditions  in  which  this  system  can  be;  three  are  failures  and  five  are 
successes. 


Table  B1 


Possible  Conditions  for  Example 


S 

Lamp  1 0 

Lamp  2 0 

Lamp  3 _0 

i = 0 


S $ S 


X 

0 

0 


0 

X 

0 


0 

0 


i 


= 1 
= 3 


F S F F 


X 

X 

0 


X 0 

0 X 


X 

X 

X 


i = 2 


Wi  = 1 


i = 3 


W.  = 0 


S = Success 
F = Failure 
0 = Light  operating 
X = Light  failed 


X 
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X 


The  system  reliability  is 


1=0 


R = 1R^'°(1-R  f + 
s u u' 


3R^"^i-R  ; 
u u' 


1R^'^{1-R  f + 

u ' u' 


Thus  the  reliability  of  any  linear  system  can  be  determined  from  Eq  Bl2 
if  Rg  and  are  known.  Determination  of  R,j  was  described  in  the  previous 
section.  For  linear  systems,  is  a multivariate  integer  function  of  n, 

NC,  and  i.  For  each  (n,  NC,  i)  there  is  a unique  constant  which  is  defined 
here  as  the  consecutive  coefficient,  C(n,NC,i).  (Appendix  C describes  the 
derivation  of  the  consecutive  coefficient.)  Substituting  the  consecutive 
coefficient  for  Wj  in  Eq  B12  gives  the  final  form  of  the  equation  used  to 
determine  reliability  of  linear  lighting  systems. 


R 


s 


NR  , 

= I C(n,NC,i)R"''(l-Rj' 


[Eq  B13] 


Bar  System  Reliability 

Determination  of  the  reliability  of  a bar  system  is  an  extension  of  the 
method  for  determining  linear  system  reliability.  Thus,  bar  system  relia- 
bility is  also  a function  of  and  Wj  and  conforms  to  Eq  B12.  However,  the 
number  of  ways  i outages  can  be  distributed  in  a bar  system  without  system 
failure  (Wj)  must  be  determined  in  accordance  with  failure  criteria  for  bar 
systems.  These  failure  criteria  stipulate  the  number  of  random  outages 
allowed  (NR),  the  number  of  consecutive  bar  failures  allowed  (NC),  and  the 
number  of  outages  in  a bar  which  constitutes  failure  of  the  bar  (FB). 
Accounting  for  all  these  criteria  makes  determination  of  W^  quite  complex. 

For  each  i outages,  where  i equals  0 to  NR,  the  outages  are  distributed 
between  failed  and  nonfailed  bars.  This  can  be  expressed  as 

MAX 

W.  = I NW(IB,i)  [Eq  B14] 

’ IB=MIN 


where  IB  = the  number  of  failed  bars  in  the  system 


MIN  = the  minimum  number  of  possible  bar  failures  assuming  i 
outages 

MAX  = the  maximum  number  of  possible  bar  failures  assuming  i 
outages 
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i = the  number  of  lamp  outages  in  the  system 

NW(IB,i)  = the  number  of  ways  that  the  system  can  be  in  a success  state 
assuming  IB  bar  failures  and  i total  outages. 


For  each  assumed  IB  between  MIN  and  MAX,  a range  of  the  number  of  out- 
ages in  the  failed  bars  will  satisfy  each  IB  assumption.  This  range  will 
be  from  (FB)(IB)  to  (NLB)(IB),  where  NLB  is  the  number  of  lights  in  a bar. 
In  addition  to  the  distribution  of  outages  between  failed  and  nonfailed 
bars,  the  possibility  of  an  outage  occurring  at  any  location  within  a bar 
must  also  be  considered.  To  account  for  all  these  interactions,  the 
mathematical  interpretation  of  NW(IB,i)  is  divided  into  four  terms  as 
follows : 


NW(IB,i ) 


i T p 

I ,NB-IB,  • NLB^  • K • C(NB,NC,IB) 
IR=0WR  ‘ 

1^  2 3 4 


[Eq  B15] 


where  IB 


the  number  of  bar  failures  in  the  system  from  MIN  to  MAX 


i = the  total  number  of  outages  in  the  system  from  0 to  NR 
IR  = the  number  of  outages  in  nonfailed  bars  from  0 to  i 


NB  = the  total  number  of  bars  in  the  system 
NLB  = the  number  of  lights  in  a bar 

NC  = the  number  of  consecutive  bar  failures  allowed  in  the  system 
and  where  the  four  terms  are  interpreted  as: 

= the  number  of  ways  the  IR  outages  can  be  distributed  among  the 
NB-IB  nonfailed  bars,  or  the  factorial  expansion  of  NB-IB  ele- 
ments taken  IR  at  a time 

I R 

NLB  = the  number  of  ways  the  IR  outages  can  be  distributed  within 
bars  having  NLB  lights,  or  NLB  to  the  IR  power 


K 


the  number  of  ways  that  i-IR  outages  can  be  distributed  in  the 
failed  bars,  or 


K = 


NLB 

n 

IH=FB 


,NLBvJ(IH) 
^ IH  ' 


or 


the  product  of  the  factorial  expansions  of  NLB  elements  taken 
IH  at  a time  and  raised  to  the  J(IH)  power  where  J(IH)  is  the 
number  of  failed  bars  with  exactly  IH  outages  in  the  bar. 
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C(NB,NC,IB)  = the  number  of  ways  that  IB  failed  bars  can  occur  in  NB  total 
bars  with  no  more  than  NC  consecutive  failed  bars.  This  is 
the  consecutive  coefficient  previously  discussed. 

Thus,  NW(IB,i)  is  a complex  function  of  the  number  of  outages,  the 
location  of  outages  in  the  bar  system,  the  location  of  outages  within  failed 
and  nonfailed  bars,  and  the  consecutive  bar  failure  criteria.  The  summation 
of  the  NW(IB,i)  terms  from  MIN  to  MAX  provides  the  total  number  of  ways  that 
i outages  can  occur  in  the  system  while  remaining  in  the  success  state. 

From  Eqs  B14  and  B15,  the  bar  system  reliability  can  be  expressed  as; 


NR 


R = y W.r"‘''(1-R 

S 1 u ' u' 


1=0 


NR  MAX  „ . . 

R^  = y y NW(IB,i)R;;"'(l-Rj’ 


^ i=o  IB=MIN 


NR  MAX  ■'  wD  TR  TD 

R = y I I (^Tn“)  • NLB^^-K  • C(NB,NC,IB)  • r""’ 
^ i=o  IB=MIN  IR=0  “ 


(l-R 
' u' 

[Eq  B16] 


Analyzing  this  expression  efficiently  requires  use  of  a digital  computer. 
The  computerized  procedure  is  discussed  in  Appendix  D. 
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APPENDIX  C: 


THE  CONSECUTIVE  COEFFICIENT 


Introduction 

The  reliability  of  an  airfield  lighting  system  is  the  probability  that 
the  system  will  be  in  a success  state.  The  success  state  is  defined  by  the 
system  failure  criteria,  which  stipulate  the  allowed  number  and  location  of 
outages  in  the  system. 

If  the  failure  criteria  only  stipulated  the  number  of  outages,  the 
system  reliability  would  conform  to  the  binomial  distribution,  which  can  be 
expressed  as 


NR 


R = y ('?)r"'''(1-R  )’ 
s ' u u' 


1=0 


[Eq  Cl  ] 


where  R^  = system  reliability 


n = number  of  lights  in  the  system 


NR  = number  of  outages  allowed 


i = number  of  outages 

R^  = probability  of  a light  being  in  a success  state 
(1-R^j)  = probability  of  a light  being  in  a failed  state 
(^)  = the  binomial  coefficient. 

The  binomial  coefficient  represents  the  number  of  ways  that  i outages  can 
be  distributed  in  n lights  while  the  system  remains  in  the  success  state. 

In  this  case,  since  the  system  must  be  in  either  a success  or  a failed  state 
when  there  are  i outages,  the  binomial  coefficient  is 

n! 

i ! (n-i ) ! 

The  system  reliability  would  then  be  the  sum  of  the  products  of  the  number 
of  ways  i outages  can  occur  in  the  system  times  the  probability  of  i outages 
occurring  over  the  range  from  i equals  0 (no  outages)  to  i equals  NR  (the 
failure  criterion). 

However,  failure  criteria  for  airfield  lighting  systems  also  stipulate 
the  manner  in  which  outages  may  occur.  This  stipulation  is  typically  given 
as  the  maximum  number  of  consecutive  outages  allowed.  Thus,  for  a given  i 
outages,  the  system  can  either  be  in  a success  or  a failed  state  depending 
on  the  location  of  the  outages.  This  results  in  a total  number  of  ways  for 


A 
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i outages  to  occur  with  the  system  in  a success  state  which  is  less  than 
(or  in  some  cases  equal  to)  the  binomial  coefficient. 

Consequently,  to  account  for  the  outage  location  failure  criterion,  a 
consecutive  coefficient  was  derived  to  replace  the  binomial  coefficient. 
The  reliability  function  for  an  airfield  lighting  system  can  then  be  de- 
termined from 


NR  n 1 i 

R = I [C(n,NC,i)R"''(l-R  )’]  [Eq  C2] 

i=o 

where  C(n,NC,i)  = the  consecutive  coefficient  for  i outages  in  an  n-lamp 
system  where  not  more  than  NC  consecutive  outages  can 
occur. 


Derivation  of  the  Consecutive  Coefficient 


The  consecutive  coefficient,  C(n,NC,i),  is  an  integer  function  of  the 
number  of  lights  (n),  the  consecutive  outages  allowed  (NC),  and  the  total 
number  of  outages  in  the  system  (i).  This  coefficient  is  the  number  of 
ways  that  i outages  can  be  distributed  in  n linearly  aligned  lights  with- 
out having  more  than  NC  consecutive  outages. 

The  consecutive  coefficient  has  been  found  to  be  a recursive  function 
which  can  be  expressed  by 

C{n,NC,i)  = C(n-l,NC,i)  + 

C(n-l,NC.i-l)  - [Eq  C3] 

C(n-NC-2,NC,i-NC-l ) 

Using  this  relationship,  the  consecutive  coefficients  can  be  derived  for 
any  set  of  (n,NC,i)  starting  with  the  following  intuitive  properties: 

a.  C(n,NC,i ) = 0 if  n < i 

b.  C(n,NC,i)  = (^),  the  binomial  coefficient,  if  NC  :•  i 

c.  C(n,NC,i)  = 0 if  n = i and  NC  < i 

d.  C(n,NC,i)  = 1 if  n = NC  = i 

Figure  Cl  shows  the  program  listing  for  a computerized  procedure  de- 
veloped to  calculate  the  consecutive  coefficients.  The  program  is  written 
in  PASCAL  computer  code,  since  FORTRAN  does  not  directly  allow  for  recursive 
calculations . 

Figure  C2  shows  a sample  of  consecutive  coefficients.  Note  that 
C(3,l,l)  = 3;  i.e.,  one  outage  (i)  can  occur  in  a three-lamp  system  (n) 
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PROGRAM  CONSECTdNPUT, OUTPUT. TAPE.3)  ; 

TYPE  MAT=ARRAY«-5. . 150.  1..  5. -5. .30!  OF  REAL! 
VCT=ARRAY«1..150!  OF  REAL! 

VAR  I ,N,K,j: integer; 

TAPE3:TEXT; 

IT. IX, IP  tINTEGER; 

NN.Ni : integer; 
factrl: vct; 
c:mat  ; 

R.TtREAL; 

P.StREAL; 

FUNCTION  A(N,K,j;lNTEGER) ;REAL; 

VAR  B:REAL; 

BEGIN 

IF  CeN,K,J!>-l  THEN  B:=CirN,K,J! 

ELSE  IF  J<=0  THEN  B;=1.0 
ELSE  IF(N=J)  AND  (K>=J)  THEN  B:=1.0 
ELSE  IF{N=J)  AND  (K<J)  THEN  B;=0.0 

ELSE  IF  (J>  N)  OR  (K<=0)  THEN  B;=0.0 

ELSE  IF  K>=J  THEN  B : =F ACTRLt N ! / ( F ACTRLH J I *F ACTRLJN- J ! > 
ELSE  B:=A (N-1 ,K, J) ♦A (N-1 .K, J-1 ) -A (N-K-2,K, J-K-1 ) ; 

a;=b; 

IF  (N>0)ANO(K>0) AND(J>0)  THEN  C« N ,K . J ! ; =B ; 

end; 

BEGIN 

FOR  l:=l  TO  150  DO 
BEGIN 

FACTRL<ri  I ; = i ; 

FOR  j;=l  TO  I DO  FACTRL«I ! :=FACTRL«I !*j; 

END; 

FOR  N:=-2  to  150  DO  BEGIN 

FOR  k:=1  to  5 DO  BEGIN 

FOR  J:=-2  TO  30  DO 

C«N,K, J! :=-2; 

end; 

end; 

LINELIMIT(0UTPUT, 150*10*20) : 

FOR  K:=1  to  2 DO  BEGIN 
FOR  N:=1  to  36  DO  BEGIN 

nn;=(n*i)  div  (2)  ; 

FOR  j;=l  TO  NN  DO  BEGIN 
WRITE(TAPE3  ,N .K , J. A (N , K , J ) ) ; 

WRITELN (TAPE3  ); 

END; 

end; 

END; 

FOR  K;=1  to  3 DO  BEGIN 
for  N:=A0  to  150  DO  BEGIN 
Ni ; = (N)  DIV  ( 5) ; 

FOR  j;=l  TO  NI  DO  BEGIN 
writE(Output,n.k,j,a(n,k,j) ) ; 
end; 

END; 

END; 

END. 


Figure  Cl.  Consecutive  coefficient  program  listing. 
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Figure  C2  (cant'd). 


without  more  than  one  consecutive  outage  (NC)  in  exactly  three  ways.  As 
another  example,  C(112,3,2)  = 6216;  i.e.,  two  outages  can  occur  in  a 
112-ldmp  system  without  more  than  three  consecutive  outages  in  exactly 
6216  ways. 

Figure  C3  illustrates  the  effect  of  considering  consecutive  outages 
in  addition  to  the  total  number  of  outages.  Curve  1 is  the  binomial  co- 
efficient, where  consecutiveness  is  not  considered.  Curves  2,  3,  4,  and  5 
consider  a failure  criterion  of  4,  3,  2,  and  1 consecutive  outages  respect- 
ively. For  the  case  of  NC  = 1 (curve  5),  the  system  becomes  failed  when 
any  two  adjacent  lights  are  out.  For  a given  n,  C{n,NC,i)  approaches  the 
binomial  coefficient  as  NC  increases.  As  n increases,  all  of  the  curves 
approach  Curve  1.  However,  it  should  be  noted  that  C(n,NC,i)  is  on  a 
logarithmic  scale  and  that  although  the  divergence  of  the  curves  may  appear 
small  for  large  n's,  the  difference  between  coefficients  is  large. 


Figure  C3.  Comparison  of  binomial  and  consecutive  coefficients. 


Although  defined  for  application  to  the  analysis  of  airfield  lighting 
system  reliability,  the  consecutive  coefficient  can  be  applied  to  any 
problem  in  which  the  probability  of  consecutive  events  is  significant.  Fur- 
ther description  of  the  derivation  and  use  of  the  consecutive  coefficient 
may  be  found  elsewhere.^ 

Kuo  and  f.  S.  Lindow,  Reliabilitv  Analysis  of  Airfield  Lighting  Systems, 
paper  prepared  for  presentation  to  the  Twenty-second  Conference  on  the 
Design  of  Experiments  in  Army  RD&T,  Adelphi,  MD,  20  October  1976. 


66 


Implementation  of  the  Consecutive  Coefficient 

The  consecutive  coefficient  must  be  determined  for  each  number  of 
outages  (i)  up  to  the  number  allowed  in  the  system  (NR).  Since  the  con- 
secutive coefficient  function  is  recursive,  the  computer  time  and  memory, 
and  therefore,  the  cost,  of  determining  the  coefficients  become  excessive. 
Thus,  constructing  a data  base  for  the  anticipated  ranges  of  n,  NC,  and 
i becomes  efficient.  The  coefficients  required  in  an  analysis  can  then 
be  selected  from  the  data  base  without  incurring  the  computer  time  and  ex- 
pense for  calculating  them.  Such  a data  base  was  constructed  for  use  with 
the  computerized  procedure  discussed  in  Appendix  D.  The  data  base  in- 
cludes consecutive  coefficients  for  the  following  ranges:  n from  1 to  150, 
NC  from  1 to  5,  and  i from  0 to  20  percent  of  n.  This  data  base  is  cur- 
rently included  with  the  program  deck,  and  its  operation  is  discussed  in 
Appendix  0. 


APPENDIX  D: 


PROGRAM  DOCUMENTATION 


A computer  program  was  developed  to  aid  in  evaluating  the  reliability 
of  airfield  visual  guidance  lighting  systems.  The  program--Rel lability 
Analysis  of  Airfield  Lighting  Systems  (RAALS)--is  designed  to  estimate  the 
present  steady-state  reliability  of  any  such  lighting  system.  The  program 
can  evaluate  all  of  the  diverse  lighting  systems  by  using  a general  light- 
ing system  model  and  adapting  it  to  a specific  system  through  the  selec- 
tion of  user  input.  Appendix  A presents  the  general  lighting  system  model 
and  its  components'  characteristics.  The  reliability  theory  methodology 
employed  in  the  program  is  discussed  in  Appendix  B. 

For  further  information  on  the  development  or  use  of  the  RAALS  program, 
contact  U.S.  Army  Construction  Engineering  Research  Laboratory,  Engineering 
and  Materials  Division,  P.  0.  Box  4005,  Champaign,  IL  61820. 


RAALS  Program  Logic 

The  RAALS  program  models  the  system  reliability  logic  presented  in 
Appendix  B.  Essentially,  this  entails 

a.  Determining  component  reliability  functions 

b.  Estimating  unit  reliability  through  simulation 

c.  Calculating  system  reliability. 

Figure  D1  shows  a simplified  logical  flow  chart  for  the  RAALS  program. 
The  procedure  includes  an  exact  solution  to  the  number  of  possible  states 
the  system  can  be  in  while  remaining  operational  and  a stochastic  solution 
for  the  possibility  of  each  state  occurring. 


Program  and  Subroutine  Functions 

Table  D1  lists  and  describes  the  program  and  subroutine  functions 
included  in  RAALS. 


RAALS  Input  Requirements 

Table  D2  lists  input  data  cards  required  for  the  operation  of  the 
RAALS  program.  The  table  also  describes  the  cards'  format  and  content. 
Appendix  B provides  further  explanation  for  determining  appropriate  values 
for  the  input  variables. 
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Figure  D1 


Simplified  logical  flow  chart  for  RAALS  program. 
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i = l (component  no.) 


Table  D1 


Program  and  Subroutine  Functions 


Program  or 
Subroutine  Name 

MAIN 


STATIS 

CNSCPB 


FACTOR 


CPW 

APW 

CNPN 

BULB 

XLENS 

FIXTUR 

SCABLE 

PCABLE 

REGULA 

TRANSF 

FI 

OTHER 

BARSYS 


Description 

This  program  functions  as  the  driver  in  the  RAALS 
program.  It  reads  the  input  cards  into  COMMON  and 
calls  the  subroutines  required  to  perform  certain 
calculations.  MAIN  also  contains  the  unit  relia- 
bility computational  procedure  and  all  of  the  PRINT 
statements . 

This  subroutine  performs  the  calculation  of  mean  and 
variance  for  unit  reliability  and  system  reliability. 

This  function  selects  the  appropriate  consecutive 
coefficients  from  the  data  base  and  computes  the 
system  reliability  for  linear  series  systems  using 
Eq  B13: 

NR  n H n- 

R = [ [C(n,NC,i)]  R"  (1-R,,) 

5 i=0  u u 

This  subroutine  computes  the  binomial  coefficient 

n I 

for  situations  with  no  consecutiveness 

1 ! (n-i ) ! 

criterion.  This  coefficient  then  replaces  C(n,NC,i) 
in  the  system  reliability  equation. 


These  12 
for  each 


Rci(t)  ■ 


functions  compute  the  reliability  function 
of  the  12  components  using  Eq  B6. 
c_ 


m 


This  function  computes  the  system  reliability  for 
bar  systems  using  Eq  B16: 
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Table  D1  (cont'd) 


NR 

= I 
10 


MAX 

IB=MIN 


IR=0 


^ IR  ' 


NLB 


IR 


C(NB,NC,IB)  • r""’’  . (1  - R^)^ 

STPLT  1 This  subroutine  is  used  to  plot  the  component 

reliability  functions  and  the  distribution  of 
system  reliability. 

RANF  This  function  is  a random  number  generator  between 

0 and  1 .0,  exclusive. 
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Table  D2 


Input  Data  Cards  for  RAALS 


Card 


Type 

Columns 

Format 

Description 

A 

1-30 

30A1 

The  geographic  location  or  other 
identification  title  of  the 
lighting  system  being  analyzed 
consisting  of  up  to  30  alpha- 
numeric characters. 

B 

1-17 

17A1 

The  type  and/or  identification 
of  the  lighting  system  (e.g., 
ALSF-ll , or  R/W  Centerline). 

18-20 

3X 

B1  ank 

21-30 

F10.2 

System  failure  criteria  stipulat- 
ing the  percent  of  random  outages 
constituting  system  failure. 
Entered  as  a percent. 

31-35 

5X 

Blank 

36-37 

12 

System  failure  criteria  stipulat- 
ing the  number  of  consecutive 
outages  or  consecutive  bar  fail- 
ures constituting  system  failure. 
Entered  as  a right-justified 
integer. 

38-40 

3X 

Blank 

41-42 

12 

Number  of  lamps  in  a light  bar. 
For  linear  series  systems  (e.g., 
centerline)  use  1.  Entered  as  a 
right-justified  integer. 

C 

1-10 

F10.2 

Average  number  of  hours  per  day 
during  which  the  system  is 
operational . 

11-20 

F10.2 

Average  number  of  days  per  year 

during  which  the  system  is 
operational . 
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Table  D2  (cont'd) 


Card 

Type  Columns Format 


1-5 

15 

6-10 

15 

11-20 

F10.2 

21-30 

F10.2 

31-40 

F10.2 

41-50 

F10.2 

51-80 

*See  Appendix  B for  definition  of 


Description 

Card  types  D through  0 provide 
the  characteristics  of  each  com- 
ponent as  follows: 

D --  Commercial  power 
E --  Auxiliary  power 
F --  Control  panel 
G --  Control  circuit 
H --  Control  vault 
I --  Regulator 
J --  Primary  cable 
K --  Isolating  transformer 
L --  Secondary  cable 
M --  Fixture 
N --  Lens 
0 --  Lamp 

The  information  on  each  card  con- 
sists of  the  following; 

Number  of  this  type  component  in 
the  system.  Entered  as  a right- 
justified  integer. 

Average  number  of  failures  per 
year  for  this  component  in  this 
system.  Entered  as  a right- 
justified  integer. 

Replacement  time*  for  this 
component  (hours). 

Safety  time*  for  this  component 
(hours ) . 

Average  down-time*  per  failure 
for  this  component  (hours). 

Design  life  for  this  component 
(hours ) . 

This  field  is  reserved  for  user 
comments.  It  is  not  read  by  the 
program. 

these  terms. 
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RAALS  Program  Operation 


The  RAALS  program  is  written  in  FORTRAN  Extended  for  CDC  6000  series 
computers.  It  was  developed  using  a CDC  6600  computer;  with  proper  modi- 
fications, the  program  is  adaptable  to  operation  on  other  computer  systems. 

Figure  D3  shows  the  deck  setup  for  the  CDC  6600  computer.  The  individ- 
ual parts  of  the  deck  are  described  in  Table  D3. 


Figure  D2.  RAALS  deck  setup. 


Example  Problem 

The  centerline  bars  of  a typical  ALSF-II  installation  were  selected  to 
illustrate  the  use  of  the  RAALS  program.  Figure  D3  shows  the  input  cards 
for  the  example.  Table  D4  provides  an  explanation  of  each  input  variable. 
The  program  output  (Figure  D4)  includes  a title  page,  input  data  listing, 
plots  of  each  component  reliability  function,  table  of  unit  and  system 
reliabilities  for  each  of  20  program  iterations,  a plot  of  the  system 
reliability  distribution,  and  the  mean  system  reliability  and  its  variance. 

The  system  reliability  for  this  example  is  0.996016  with  a variance 
of  2.442  X 10*6.  Thus,  the  system  is  expected  to  be  operational  99.6 
percent  of  the  time  with  a standard  deviation  of  + 0.16  percent.  Since  the 
variance  of  the  system  reliability  estimates  is  small  for  these  data,  the 
resulting  steady-state  system  reliability  may  be  considered  to  be  a good 
approximation  of  the  availability  expected  from  this  system.  A large 
variance,  on  the  order  of  10*^  or  10*^,  would  indicate  that  the  system  con- 
tains at  least  one  component  whose  reliability  fluctuates  widely.  In  this 
case,  the  plotted  component  reliability  function  should  be  examined  to 
determine  how  the  system  reliability  can  be  improved. 
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Table  03 


RAALS  Deck  Setup 


Type 

Cards 

Notes 

Job  Control 

Job  Card 

Identifies  the  job  and  stipulates 
job  parameters.  A minimum  of 

CMl 50000  and  T200  is  suggested. 

Charge  Card 

Cost  accounting  card  (installation- 
dependent)  . 

COPYCR  (Input, 
Consec ) 

Copies  the  Consecutive  Coefficient 
Data  Base  from  the  INPUT  file  to 
the  file  CONSEC  for  program  usage. 

FTN. 

Compiles  the  RAALS  program.  Other 
parameters  for  compilation  may  be 
specified. 

LGO. 

Loads  and  executes  RAALS. 

7/8/9 

End-of-Record  card.  7,8,9  all 
punched  in  column  one. 

Consecutive 

Coefficient 

Data  Base* 

7/8/9 

RAALS 

Program* 

7/8/9 

Input  Deck 

Card  types  A 
through  0 

The  input  deck  consists  of  the  15 
card  types  described  in  Table  D2. 

6/7/8/9 

End-of-Information  card. 

*The  job  control  cards  and  the  deck  setup  assume  that  all  the  in- 
formation is  on  cards  and  the  job  is  run  on  CDC  6000  series  computers. 
If  the  RAALS  program  and  data  base  are  on  a permanent  file  or  mag- 
netic tape,  the  job  control  cards  and  the  deck  setup  would  be  changed. 
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DATE  80  COLUMN  KEY  PUNCH  TRANSCRIPT  LAYOUT  SHEET  SHEET  OF ^EETS 


Figure  D3.  Example  problem  input  data. 


Table  D4 


Input  for  Example  Problem 


EXAMPLE  PROBLEM 

(An  identification  title  for  this  problem.) 


ALSF-2  CENTERLINE  20.0  2 5 

(The  system  being  analyzed  is  an  ALSF-II  with  failure  criteria  of  20 
percent  outages  and  two  consecutive  bar  failures  in  a bar  system 
having  five  lamps  per  bar.) 


12.0  365. 

(The  system  operates  an  average  of  12.0  hours  per  day,  365  days  per 

year. ) 

1 1 175000.  0.  24.  175000. 

(The  commercial  power  component  characteristics; 

a.  There  is  one  commercial  power  component 

b.  It  is  estimated  to  fail  once  per  year  from  past  records 

c.  Since  this  component  is  not  expected  to  be  replaced  during 
its  design  life,  the  replacement  time  is  set  at  175,000 
hours  (equivalent  to  a 20-year  design  life) 

d.  The  safety  time  is  zero,  i.e.,  the  component  has  a probability 
of  failing  any  time  after  installation 

e.  From  past  records,  it  is  estimated  that  this  component  re- 
quires an  average  of  approximately  24  hours  downtime  per 
fai lure 


f.  The  design  life  for  this  component  is  20  years  or  175,000 
hours. ) 


1 1 

(Auxi 1 iary  Power) 

175000. 

0. 

36. 

175000. 

1 1 

(Control  Panel ) 

175000. 

0. 

24. 

175000. 

1 1 

(Control  Circuit) 

100000. 

0. 

24. 

100000. 
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Table  D4  (cont'd) 


1 3 100000. 

(Control  Vault  Equipment) 

0. 

12. 

100000. 

3 2 

(Regulator) 

175000. 

0. 

24. 

175000. 

3 3 

(Primary  Cable) 

100000. 

0. 

12. 

175000. 

150  15  60000. 

(Isolating  Transformers) 

0. 

24. 

60000. 

150  40 

(Secondary  Cables) 

60000. 

0. 

48. 

60000. 

150  25 

(Fixtures) 

60000. 

0. 

% 

36. 

60000. 

150  75 

(Lenses ) 

40000. 

0. 

24. 

40000. 

150  160 

8000. 

0. 

24. 

10000. 

(Lamps  --  Note:  the  replacement  time  for  this  component  is  based  on 
group  relampment  at  80  percent  of  the  design  life.  The  design  life 
of  the  lamp  is  500  hours  at  maximum  intensity;  this  converts  to  10,000 
hours  real  time.) 
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Figure  D4.  Example  problem  output. 


location:  example  problem  system  type:  alsf-2  centerline 
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30*  LIGHT  FAILURES  IN  A BAR  CONSTITUTES  LIGHT  BAR  FAILURE 
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PRINTED  values  OF  X ARE  l.OE  -5  TIMES  ACTUAL  VALUES 


r 


85 


86 


87 


Figure  D4  (cont'd). 
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Figure  D4  (cont'd). 
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Figure  D4  (cont'd). 
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Figure  D4  (cont'd). 


PRINTED  VALUES  OF  X ARE  l.OE  -A  TIMES  ACTUAL  VALUES 


93 


Figure  D4  (cont'd). 
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Figure  D4  (cont'd) 


ITERATION  MEAN  UNIT  REL  VAR  UNIT  «EL  STSTtM  REL 


y-  O'  -C  «o-^>f»-xrOru.*nfnirt« 
■^x-v/N.*..  xt  nj  'n 

Xr>-r»r«>xirrwx^>0>C>iP^/)Srn<#tnp>(M 
yyyyyyyyyyyyyyyyo'O-yy 
y O'  oooooooooooo  o o o o o o 


oooooooooooooooooooo 

oooooooooooooooeoeoe 

oooooooooooooooooceo 

ooeeoooooeoooooooooo 

oeoooooooooeoooeoooe 


X'vixp»®(\jxxi/)  — »nnj  — 

^•>««)r)Xo®xrox  -t 

oooooooooooooooooooo 


^ — « — — — 


U>  IV 
t-  ♦ 

>■  (V 
</)  o 
o 
z o 
< o 


3 <X 

a « 
z > 


95 


Figure  D4  (cont'd). 


APPENDIX  E: 


SENSITIVITY  ANALYSIS 


The  analytical  procedure  used  in  the  RAALS  program  combines  individual 
analyses  of  the  dependent  variables  as  shown  by  the  tree  structure  in 
Figure  El.  Although  the  elements  at  a given  level  are  listed  separately, 
interactions  tend  to  confound  the  individual  elements'  effects  on  the  next 
higher  level.  This  appendix  presents  a sensitivity  analysis  aimed  at 
isolating  the  dependent  variables'  effects  at  three  levels:  the  component 
reliability,  the  unit  reliability,  and  the  system  reliability.  The  dis- 
cussion centers  on  the  physical  effects  of  varying  the  ind'vidual  elements 
rather  than  solely  on  the  mathematical  repercussions. 


where  C = the  maintenance  coefficient 
m 

= the  failure  coefficient 
t^  = the  safety  time. 


In  the  tree  structure  in  Figure  El,  the  four  elements  directly  affecting 
component  reliability  are:  replacement  time,  safety  time,  maintenance, 
and  component  failures.  These  elements  are  discussed  below. 

Heplacement  Time 

The  replacement  time  is  defined  as  the  period  of  time  during  which  a 
particular  component  is  expected  to  be  in  service.  Figure  E2  shows  the 
effect  of  reducing  lamp  replacement  time  while  holding  other  variables 
constant,  using  typical  characteristics  for  a lamp  component  (Table  El). 

As  time  to  replacement  decreases,  the  reliability  curve  retains  the  same 
form  but  is  truncated  earlier.  In  a steady-state  system,  the  overall 
effect  of  decreasing  replacement  time  is  to  improve  the  component's  relia- 
bi  1 i ty . 

Since  replacement  time  is  a function  of  maintenance  policy,  it  can  be 
directly  controlled.  However,  when  the  maintenance  policy  is  established, 
the  costs  incurred  by  replacing  components  prior  to  their  design  life  must 
be  weighed  against  the  resulting  improvement  in  system  reliability. 
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Figure  El.  Tree  structure  of  reliability  analysis 
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Table  El 


Typical  Lamp  Characteristics 


C(M|>onent 

Type 

Number 

Failures 
Per  Year 

Repi acement 
Time 
(Hrs) 

Safety 

Time 

(Hrs) 

Down- 

time 

(Hrs) 

Design 

Life 

(Hrs) 

Maintenance 

Coefficient 

Failure 

Coefficient 

Lamp  1 

150 

150 

4000 

0 

12 

4000 

.647456 

504100 

Laap  2 

150 

150 

3000 

0 

12 

4000 

.647456 

50,000 

Laap  3 

150 

150 

2000 

0 

12 

4000 

.647456 

50,000 

Safety  Time 

1 The  safety  time  for  a component  is  the  period  following  installation 

during  which  the  possibility  of  failure  is  zero  or  the  reliability  is  1.0. 
Figure  E3  shows  the  effect  of  safety  time  on  the  component  reliability 
curve.  These  curves  were  generated  using  the  standard  set  of  data  in 
Table  El  and  varying  the  safety  time.  The  net  effect  of  increasing  safety 
time  is  to  improve  the  reliability  of  the  steady-state  component.  Because 
safety  time  is  an  attribute  of  the  individual  equipment  item's  design  and 
manufacture,  it  cannot  be  controlled  except  through  equipment  selection. 


Figure  E3.  Effect  of  safety  time  on  reliability  curve. 
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Maintenance,  which  includes  both  corrective  and  preventive  maintenance 
activities,  is  accounted  for  in  the  reliability  function  by  a maintenance 
coefficient  (see  Appendix  B,  The  Maintenance  Coefficient  section). 

As  shown  in  Figure  E4,  the  maintenance  coefficient  increases  exponen- 
tially with  increasing  downtime.  From  Eq  El,  as  the  maintenance  coefficient 
approaches  0,  component  reliability  approaches  1,  and  as  the  maintenance 
coefficient  approaches  1,  the  reliability  approaches  0.  Thus,  the  component 
reliability  decreases  with  increasing  downtime.  Figure  E5  illustrates  the 
effect  of  decreasing  the  maintenance  coefficient  on  the  shape  of  the  com- 
ponent reliability  curve. 

Downtime  is  principally  controlled  by  the  frequency  of  performance 
checks  and  the  length  of  time  required  to  make  repairs  or  replacement.  Thus, 
comprehensive  monitoring  of  a lighting  system  will  reduce  detection  time, 
thereby  decreasing  downtime  and  increasing  component  reliability.  Decreas- 
ing the  length  of  time  for  repairs  by  increasing  the  maintenance  staff, 
stocking  replacement  parts,  improving  maintenance  skills,  etc.,  will  also 
increase  component  reliability. 

Failure  Rate 

In  the  component  reliability  function,  failure  rate  is  accounted  for 
by  the  failure  coefficient.  As  the  percent  of  yearly  failures  with  respect 
to  the  total  number  of  equipment  items  in  the  system  increases,  the  failure 
coefficient  decreases  exponentially,  as  shown  in  Figure  E6.  From  Eq  1,  as 
the  failure  coefficient  approaches  0,  component  reliability  approaches  0, 
and  as  the  failure  coefficient  increases,  the  reliability  approaches  1.0. 
Figure  E7  shows  the  effect  of  the  failure  rate  on  the  shape  of  the  component 
reliability  curve. 

Since  the  failure  ratp  considers  all  causes  for  equipment  becoming 
nonoperational , there  is  interaction  between  the  failure  rate  and  pre- 
ventive maintenance.  As  preventive  maintenance  improves,  the  failure  rate 
typically  decreases.  In  addition,  any  improvement  in  the  equipment  per- 
formance brought  about  by  design  or  manufacturing  changes  will  also  de- 
crease the  failure  rate. 


Unit  Reliability  Sensitivity 

The  unit  reliability  is  determined  by 

Ry  = [1  - (1-Ri)(1-R2)]  R3  •••  Ri2  E2] 

However,  since  each  component  reliability  is  a distribution  rather  than  a 
single  point,  the  Monte  Carlo  simulation  routine  described  in  Appendix  B 
was  used  to  determine  a mean  unit  reliability.  This  routine  causes  the 
unit  reliability  to  be  a function  of  the  system  geometry  as  well  as  the 
component  reliabilities,  as  shown  in  Figure  El. 
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DOWNTIME,  (HOURS) 


100 


75  - 


0.2  0.4  0.6  OB  1.0 

MAINTENANCE  COEFFICIENT 

Figure  E4.  Maintenance  coefficient  vs.  downtime. 
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coefficient  on  reliability  curve 


The  geometry  of  existing  systems  is  not  a variable.  However,  the  RAALS 
program  can  be  used  in  designing  new  systems  to  evaluate  the  effect  of  the 
geometry  (e.g.,  the  number  of  primary  cables  in  the  system)  on  reliability. 

Eq  E2  indicates  that  improving  the  reliability  of  any  one  component 
improves  the  unit  reliability.  However,  since  unit  reliability  is  the  pro- 
duct of  the  individual  component  reliabilities,  the  unit  reliability  is 
influenced  most  by  the  weakest  link  in  the  system. 


System  Reliability  Sensitivity 

The  system  reliability  is  a function  of  the  unit  reliability  and  the 
system  failure  criteria,  as  discussed  in  Appendix  B and  expressed  by 

R [Eq  E3] 

i=o 


where  R 


the  unit  reliability 

the  number  of  outages  in  the  system 

the  total  number  of  lights  in  the  system 

the  number  of  ways  i outages  can  occur  in  the  system  without 
system  failure  (i.e.,  the  failure  criteria). 


System  Failure  Criteria 

The  system  failure  criteria  are  subjective  standards  established  to 
determine  the  minimum  lighting  requirements  necessary  to  convey  sufficient 
information  to  the  pilot  of  an  aircraft  to  maintain  safe  operations.  In 
general,  the  failure  criteria  stipulate  a percentage  of  random  failures 
(NR)  and  a number  of  consecutive  failures  (NC). 

Since  the  system  failure  criteria  are  based  on  an  appraisal  of  the 
amount  of  information  required  by  the  pilot,  the  failure  criteria  are  not 
a variable  in  the  reliability  analysis  in  the  sense  that  they  can  be  changed 
arbitrarily.  However,  if  research  indicates  that  the  standards  established 
for  a type  of  system  should  be  revised,  the  RAALS  program  can  be  used  to 
estimate  the  resultant  change  in  system  reliability. 

The  effect  of  varying  the  failure  criteria  can  be  illustrated  using 
three  standard  sets  of  data  (Tables  E2  through  E4)  for  a runway  centerline 
system.  These  data  sets  provide  a range  of  unit  reliability.  Table  E5 
presents  the  resulting  system  reliability  for  the  factorial  analysis  of  the 
following  failure  criteria:  random  outages  at  5,  10,  and  20  percent,  and 
consecutive  outages  at  2,  3,  4,  and  5.  The  data  are  plotted  on  Figures  E8, 
E9,  and  ElO. 

As  anticipated,  relaxing  either  of  the  failure  criteria  increases 
system  reliability.  For  the  medium  and  low  R,j  data  sets,  this  increase  is 
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Table  E5 


Failure  Criteria  Sensitivity 


NR 


5%  1 0%  20% 


R 

u 

T 

''s 

V 

R 

s 

V 

R 

s 

V 

2 

.4883535 

.292x10"^ 

.7185789 

.702x10"^ 

.7193749 

.687x10"® 

L 

3 

.5705402 

.346x10"^ 

.9811285 

.831x10"^ 

.9833767 

.681x10"^ 

0 

W 

4 

.5728664 

.347x10"^ 

.9927543 

.972x10"^ 

.9991349 

.309x10"® 

5 

.5729187 

.347x10"^ 

.9943739 

.464x10"^ 

.9999544 

-8 

.1x10 

2 

.5661675 

.301x10"^ 

.7574718 

.660x10"^ 

.7578686 

.653x10"® 

M 

E 

3 

.6530299 

.329x10'^ 

.9847144 

.921x10"^ 

.9870361 

.474x10"^ 

D 

I 

4 

.6554182 

.329x10"^ 

.9966839 

.139x10"'^ 

.9993764 

.176x10"® 

U 

M 

5 

.6554708 

.329x10"^ 

.9972400 

.115x10"^ 

.9999696 

.1x10"® 

2 

.9751  358 

.615x10'^ 

.9753728 

.598x10"^ 

.97581 62 

.533x10"^ 

H 

I 

3 

. 9986546 

.964x10"^ 

.9991312 

.754x10"^ 

.9996754 

.21x10"^ 

G 

H 

4 

.9989582 

.732x10"® 

.9998117 

.8x10"® 

.9999956 

0 

5 

.9989619 

.729x10"® 

. 9999924 

0 

.9999999 

0 

NR  = percent  random  failures  allowed  without  system  failure 

NC  = number  consecutive  failures  allowed  without  system  failure 

R = unit  reliability 
u 

R = system  reliability 
V = variance 
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Figure  E9.  Reliability  for  medium  R^  data  set 
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SYSTEM  RELIABILITY,  Rs 


NR>  RANDOM  FAILURES 


CONSECUTIVE  FAILURES,  NC 


quite  large.  However,  for  the  high  data  set,  increasing  NR  has  only  a 
small  effect  on  system  reliability.  In  all  cases,  Rj  increases  significantly 
when  NC  is  increased  from  2 to  3.  Further  increases  in  NC  produce  only 
minor  improvement  in  the  system  reliability. 

Unit  Rp liability 

The  sensitivity  of  the  system's  reliability  to  changes  in  the  unit 
reliability  is  also  illustrated  in  Table  E5.  For  failure  criteria  of  NR 
equals  5 percent  and  NC  equals  5,  the  system  reliability  increases  from 
.5729187  for  the  low  data  set  (R^  = .95219)  to  .9989619  for  the  high  data 
set  (Ru  = .98724).  Thus,  an  increase  of  .03505  in  unit  reliability  produces 
an  increase  of  .4260432  in  system  reliability.  Figure  Ell  shows  the  re- 
lationship of  Rs  to  Ry  for  these  failure  criteria.  This  exponential  curve 
shows  that  the  rate  of  change  in  Rg  decreases  rapidly  as  Ry  approaches  Rg. 

Although  system  reliability  has  been  shown  to  be  sensitive  to  slight 
changes  in  unit  reliability,  the  physical  meaning  is  confounded  by  the 
multitude  of  variables  which  influence  the  unit  reliability.  Some  of  these 
variables  can  be  controlled  while  others  cannot.  The  following  sections 
discuss  the  sensitivity  of  a sample  of  the  controllable  variables. 

Replacement  Time 

The  Component  Reliability  Sensitivity  section  of  this  appendix  dis- 
cussed the  effect  on  the  component  reliability  function  of  decreasing  the 
replacement  time.  The  resulting  effect  on  system  reliability  can  be 
demonstrated  by  decreasing  the  replacement  time  for  the  lamp  and  lens 
component. 

Table  E6  presents  the  relationship  of  system  reliability  and  lamp  re- 
placement time  using  the  data  set  from  Table  E3  and  two  sets  of  failure 
criteria:  NR  equals  20  percent,  NC  equals  4 and  NR  equals  10  percent,  NC 
equals  3.  The  replacement  times  in  this  table  are  for  group  relampment  at 
70,  80,  90,  and  100  percent  of  the  lamp  design  life.  As  Table  E6  shows, 
for  the  higher  failure  criteria,  the  system  reliability  is  slightly  im- 
proved as  the  lamp  replacement  time  decreases.  For  the  lower  failure 
criteria,  and  thus  lower  system  reliability,  the  effect  of  decreasing  the 
lamp  replacement  time  is  more  pronounced. 

Table  E7  presents  the  effect  on  system  reliability  of  decreasing  the 
lens  replacement  time  by  50  percent*  and  varying  the  lamp  replacement  time 
from  70  to  100  percent  of  its  design  life.  The  same  data  and  failure 
criteria  were  used  as  in  Table  E6.  Again  the  impact  of  replacement  time 
is  more  pronounced  for  the  lower  system  reliabilities. 


*For  the  lens  component,  replacement  time  may  be  decreased  by  group 
restoration  and  cleansing  of  contaminants  at  some  time  prior  to  the  design 
life. 
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Table  E6 


Effect  of  Group  Relampment 


Lamp  Replacement 

Time  as  % of 

Design  Life 

R 

s 

With  NR=20%,  NC=4 

«s 

With  NR=10%,  NC=3 

70 

. 99940 

. 98534 

80 

.99939 

.98520 

90 

. 99938 

. 98501 

100 

. 99937 

.98471 

Lamp  Replacement 
Time  as  % of 
Design  Life 

Table  E7 

Effect  of  Lens  Restoration 

Lens  Replacement  Time  = 

50%  of  Design  Life 

R^  With  NR=20%,  NC=4 

R^  With  NR=10%,  NC=3 

70 

. 99942 

. 98576 

80 

.99941 

.98559 

90 

.99940 

.98524 

100 

.99939 

. 98488 

/ 


The  combined  effect  of  restoring  lenses  at  one-half  their  design  life 
and  replacing  lamps  at  70  percent  of  their  design  life  results  in  an  in- 
crease in  system  reliability  of  0.005  for  the  higher  failure  criteria  and 
0.105  for  the  lower  failure  criteria. 

Maintenance 

Airfield  lighting  systems  are  maintained  systems;  that  is,  to  serve 
their  intended  function  over  a period  to  time,  these  systems  require  main- 
tenance--both  corrective  and  preventive.  Consequently,  the  level  of  main- 
tenance employed  must  be  considered  in  evaluating  the  reliability  of  these 
systems.  The  effect  of  maintenance  on  an  individual  components 's  relia- 
bility function  was  previously  discussed.  This  section  focuses  on  the  im- 
pact maintenance  has  on  the  system  reliability. 

Downtime  is  the  principal  measure  of  the  level  of  corrective  main- 
tenance. As  previously  discussed,  downtime  is  controlled  by  the  frequency 
of  performance  checks  and  the  length  of  time  required  to  perform  repairs 
or  replacement.  To  illustrate  the  system  reliability  sensitivity  to 
variations  in  downtime,  several  typical  cases  were  analyzed.  Table  E8  pre- 
sents the  results. 

For  case  1,  the  standard  data  set  of  Table  E3  with  failure  criteria  of 
NR  equals  20  percent,  NC  equals  4 was  used  for  comparison. 

Case  2 involved  monitoring  the  entire  lighting  system  for  failures; 
the  detection  time  thus  becomes  instantaneous,  as  illustrated  in  Figure  El 2. 
For  critical  component  failures,  where  failure  of  the  component  is  also 
system  failure  (e.g.,  commercial  power,  regulator,  etc.),  the  remaining 
downtime  is  the  time  required  to  clear  the  system  of  operating  aircraft. 

For  other  component  failures  (e.g.,  lamps,  isolating  transformers,  etc.), 
the  remaining  downtime  is  the  time  to  repair  or  replace  the  component. 

Using  a conservative  estimate  of  20  percent  reduction  in  downtime  for  all 
components,  the  improvement  in  system  reliability  due  to  monitoring  would 
be  0.0282  percent. 

Overall  downtime  can  be  reduced  by  increasing  the  maintenance  staff, 
maintenance  funds,  and  maintenance  capabilities.  Conversely,  decreasing 
these  elements  increases  downtime.  Case  3 presents  the  system  reliabilities 
resulting  from  varying  the  downtime  for  all  components  by  ± 50  percent. 
Results  illustrate  that  decreasing  downtime  results  in  an. increase  in  Rj 
of  0.0603  percent  while  an  equal  increase  in  downtime  decreases  by  0.8238 
percent. 

The  first  three  cases  varied  the  downtime  of  all  components;  case  4 
illustrates  the  effect  of  varying  a single  component's  downtime.  If  the 
lamps  were  visually  checked  and  failures  replaced  each  hour,  12  hours,  or 
24  hours,  the  resulting  system  reliabilities  would  be  as  shown  in  Table  E8. 

These  examples  are  based  on  a system  having  a high  reliability  (99.9  + 
percent).  For  systems  with  lower  reliabilities  (e.g.,  95  percent),  the 
changes  caused  by  varying  the  downtime  are  much  more  significant. 
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Table  E8 


Effect  of  Maintenance 


Change 

Reason 

'^s 

Case 

in  Downtime 

for  Change 

1 

0 

Standard  set  of  data 

.999395 

2 

-20.,  all 

components 

System  monitored 

.999677 

3 

-60?i,  all 

components 

Maintenance  increased 

.999980 

+50/O,  all 

components 

Maintenance  decreased 

.991157 

4 
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where  = time  of  failure 

Tj  = time  of  detection  (T^  when  system  monitored) 

= time  system  removed  from  service  (T  does  not  exist 
when  component  failure  does  not  create  system  failure) 

= time  failure  is  corrected. 

Figure  E12.  Periods  within  component  downtime. 
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The  effect  of  a component's  failure  rate  on  its  reliability  function 
was  discussed  previously.  Table  E9  shows  the  system  reliability  sensitivity 
to  variations  in  failure  rates  for  three  components.  These  computations 
were  based  on  the  standard  data  set  in  the  previous  section.  Fluctuations 
such  as  these  can  be  attributed  to: 

a.  An  inferior  shipment  of  a component 

b.  Atypical  weather  conditions  (electrical  storms  for  example) 

c.  Improving  or  relaxing  the  level  of  preventive  maintenance 

d.  Design  or  manufacturing  changes  in  the  component  production. 


Summary 

As  described  in  this  appendix,  the  reliability  of  a lighting  system 
is  sensitive  to  all  of  the  elements  shown  in  Figure  El.  The  magnitude  of 
the  sensitivity  to  each  element  varies  with  the  interactions  between  the 
elements.  However,  the  less  reliable  a system  is,  the  more  sensitive  it 
will  be  to  changes. 

An  overriding  constraint  to  improvements  in  any  system's  reliability 
is  cost.  The  cost  of  increasing  reliability  must  be  balanced  with  the  costs 
resulting  from  not  attaining  the  increase. 

The  costs  associated  with  increasing  reliability  are  attributable  to 
equipment  purchase  and  installation  and  to  maintenance.  The  former  costs 
are  readily  obtainable,  while  the  latter  must  consider  both  corrective  and 
preventive  maintenance.  As  shown  in  Figure  E13,  as  preventive  costs  in- 
crease, the  cost  of  corrective  maintenance  decreases.  Ideally,  the  inter- 
section of  the  curves  will  provide  the  optimal  total  maintenance  cost. 


Figure  E13.  Corrective  vs.  preventive  maintenance  costs. 
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Table  E9 


Effect  of  Component  Failure  Rate 


Componetit 

Number  of 
Failures/Year 

''s 

Lamp 

75 

.999455 

Lamp 

150 

. 999395 

Lamp 

250 

. 999306 

Isolating  transformer 

0 

.999419 

Isolating  transformer 

15 

.999395 

Isolating  transformer 

30 

.999367 

Regulator 

0 

. 999507 

Regulator 

3 

.999395 

Regulator 

9 

.999103 
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In  evaluating  maintenance  costs,  the  "cost  of  excess"  should  also  be 
considered.  It  is  possible  to  provide  a system  with  a degree  of  freedom 
from  failure  far  in  excess  of  that  which  can  be  utilized.  The  cost  of 
excess  is  then  the  cost  associated  with  improving  reliability  beyond  the 
minimum  standards  acceptable  to  the  user. 

The  consequences  of  unreliability,  or  the  costs  associated  with  not 
attaining  an  acceptable  reliability,  are  even  more  complex  to  analyze. 

They  include: 

a.  Monetary  costs  incurred  by  the  destruction  of  aircraft  in  accidents 
caused  by  lack  of  visual  guidance. 

b.  Time  loss  incurred  by  passengers  and  airlines  due  to  the  inability 
to  make  scheduled  arrivals  or  departures. 

c.  Injury  incurred  during  accidents  (or  incidents)  caused  by  lack  of 
visual  guidance. 

d.  Psychological  effects  incurred  by  pilots  or  airport  managers  who 
cancel  scheduled  operations  because  they  feel  that  the  lighting  system  will 
not  provide  the  necessary  information. 

In  formulating  alternatives  and  recommending  improvements  or  changes 
to  a lighting  system,  all  of  the  aforementioned  costs  must  be  considered. 
Previously,  however,  a quantified  analysis  of  the  independent  variable-- 
system  rel iabil ity--was  unavailable.  As  demonstrated  in  this  appendix,  the 
RAALS  program  can  be  used  to  evaluate  the  system  reliability  in  light  of 
the  anticipated  changes,  thereby  providing  the  decision  maker  with  the  in- 
formation required  to  optimize  system  reliability. 
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